A high-severity memory management flaw in the Linux kernel netfilter subsystem allows a local authenticated attacker to potentially cause system instability or gain elevated privileges.

The vulnerability exists within the netfilter nft_ct module, where improper handling of conntrack expectations during extension reallocation creates stale hlist entries. This flaw requires local access and low privileges to trigger, potentially resulting in memory corruption or kernel-level code execution.

The exploitation of this kernel-level vulnerability poses a significant risk to system integrity and availability. A successful compromise could allow an attacker to crash the system, causing service disruption, or escalate local privileges to gain full control over the affected server. With a CVSS score of 7.8, this vulnerability is categorized as high severity, reflecting the potential for complete system compromise if an attacker gains local access.

Immediate Action: Update the Linux kernel to version 7.2.6 or later, or apply the upstream patches provided in the referenced git commits.

Proactive Monitoring: Monitor system logs for kernel oops, segmentation faults, or unexpected reboots, which may indicate attempted exploitation of kernel memory flaws.

Compensating Controls: Restrict local shell access to only trusted users and implement kernel-level security modules like SELinux or AppArmor to limit the potential impact of a kernel compromise.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the critical nature of kernel vulnerabilities, administrators should prioritize patching on all affected Linux systems. While the vector requires local access, the potential for privilege escalation necessitates immediate action to maintain a secure posture. Update to kernel 7.2.6 as soon as possible to remediate this flaw.