In the Linux kernel, the bpf_ct_set_nat_info() function fails to validate the NAT manipulation type, which allows an attacker to supply a wrong value that is passed directly to nf_nat_setup_info(). This triggers a WARN_ON inside nf_nat_setup_info(), and if the kernel’s panic_on_warn is unset, the IPS_SRC_NAT_DONE flag is set without adding a nat_bysource entry. Consequently, the connection‑track cleanup routine attempts to unlink an uninitialized hlist node, which can cause a kernel crash and bring the system down.

The flaw resides in the netfilter module of the Linux kernel and affects any installation that compiles the kernel with the unpatched netfilter BPF pathway. Inferred: any distribution running a kernel built with this code before the commit that added NAT type validation is vulnerable. No specific version range is listed in the advisory.

The vulnerability carries a moderate impact: if an attacker can inject a malformed NAT manipulation value via a BPF program, the kernel may trigger a WARN_ON, set the IPS_SRC_NAT_DONE state improperly, and finally crash, resulting in a denial‑of‑service. The CVSS score of 4.4 indicates moderate severity; the lack of a KEV listing and an EPSS score of < 1% suggest that public exploitation has not yet been observed. Inferred: there is no current evidence of exploitation. The vulnerability requires privileged access to load or modify BPF programs, typically via CAP_NET_ADMIN; this level of privilege is a common target for system administrators and may be abused if misconfigured. Inferred: if such privileges exist, the potential for exploitation increases. Therefore, the risk is moderate for systems that expose BPF loading to untrusted users or run with elevated capabilities, while the exploit likelihood remains uncertain.