An unprivileged local user can trigger a kernel crash by exploiting a race condition in the Linux kernel’s traffic control conntrack commit path. The flaw causes a WARN to be emitted when flow_offload_alloc() returns NULL during a conntrack flush or an atomic allocation failure; with panic_on_warn enabled this warning results in a kernel panic. The warning is benign, so the issue represents a denial‑of‑service vulnerability rather than arbitrary code execution.

The vulnerability exists in the net/sched act_ct code of the Linux kernel. All builds that have not applied the patch removing the WARN for benign flow_offload_alloc() failures are impacted; no specific kernel versions are listed in the advisory.

Extensive exploitation metrics are not published, but the flaw requires only local privileges and a race between packet processing and conntrack flushes, which a local attacker can provoke. Because the failure leads to a system reboot, the impact is a denial of service to the host. The vulnerability is not currently in CISA’s KEV catalog.