The Linux kernel conntrack module incorrectly assigns the CLOSE timeout to any RST packet, even when the packet does not cause a state transition out of ESTABLISHED. This behavior creates a short 10‑second expiration window for established connections that can be prematurely triggered by crafted non‑exact RST packets, leading to the unexpected loss of legitimate network traffic.

Affected systems are Linux kernel installations that have not yet integrated the commit adding the UNACK timeout handling for non‑closing RSTs. Because no specific version range is provided, any kernel older than that commit is vulnerable. The issue occurs in the generic Linux kernel distribution and affects all network stacks relying on the conntrack subsystem.

Based on the description, it is inferred that an attacker with remote network connectivity could send crafted non‑exact RST packets to exploit the timeout bug and cause a denial‑of‑service. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, and no public exploit has been reported, suggesting moderate risk. The likely attack vector is remote network exploitation, and the vulnerability would require only network access to the target host.