A memory leak vulnerability in the Linux kernel netfilter bridge component can lead to system-wide denial of service through slab memory exhaustion.

The vulnerability exists in the bridge nftables conntrack zone handling, where the kernel fails to release conntrack template references when processing non-IPv4 or non-IPv6 EtherTypes. An unauthenticated remote attacker can trigger this condition by sending specific network traffic, causing the kernel to leak memory until the host system crashes.

The vulnerability carries a CVSS score of 7.5, indicating a high risk of service disruption. Successful exploitation allows an attacker to induce a kernel panic or total system unavailability by depleting slab memory, which directly impacts business continuity and operational uptime for any system utilizing bridge nftables.

Immediate Action: Update the Linux kernel to version 5.10.265, 5.15.216, 6.1.183, 6.6.152, or later, depending on your distribution branch.

Proactive Monitoring: Monitor system slab memory usage and kernel logs for signs of memory pressure or unusual netfilter-related error messages.

Compensating Controls: If immediate patching is not feasible, restrict network access to the affected bridge interface using hardware firewalls or ingress filtering to block unexpected non-IP traffic patterns.

Public Exploit Available: Unknown

Given the potential for a complete system crash and the ease of triggering the flaw via standard network traffic, organizations should prioritize applying the provided kernel patches. Administrators should verify their current kernel version and apply the appropriate stable update to neutralize the memory leak risk.