A slab-out-of-bounds read vulnerability in the Linux kernel netfilter ctnetlink subsystem allows a local authenticated attacker to read kernel memory and compromise system confidentiality and integrity.

This is a slab-out-of-bounds memory read flaw (CWE-125) occurring within the netfilter ctnetlink component when handling explicit helpers on new expectations, requiring low local privileges.

A successful exploit allows an attacker with local access to read sensitive kernel memory bytes, potentially exposing cryptographic keys, credentials, or internal kernel structures. While the attack requires local execution, the high CVSS score of 7.3 reflects the severe impact on system confidentiality and potential escalation paths leading to system instability or denial of service.

Immediate Action: Update the Linux kernel to version 6.1.168, 6.6.134, 6.12.81, or later where the netfilter ctnetlink expectation validation is properly restricted.

Proactive Monitoring: Monitor system logs for kernel slab allocation errors, Kernel Address Sanitizer (KASAN) warnings, or unexpected netfilter rule modifications.

Compensating Controls: Restrict local shell access and limit user capabilities to prevent unauthorized users from executing arbitrary code or loading untrusted netfilter modules.

Public Exploit Available: Yes, a technical description and proof-of-concept trace exist within the upstream kernel patch submission and commit records.

System administrators must prioritize applying the latest upstream kernel patches to all vulnerable Linux distributions immediately. Securing local environments and restricting user access will limit exposure until patches can be deployed across production fleets.