The Linux kernel netfilter nf_conntrack subsystem had a flaw where NAT helpers like nf_nat_h323 stored raw pointers to module text in expectation callbacks (exp->expectfn). When a NAT helper module is unregistered, the callback descriptor is unlinked but the expectation table is not walked to remove stale expectations. This leaves dangling pointers to freed module code. When an expected connection arrives, the kernel calls the stale exp->expectfn pointer, causing a kernel crash (use-after-free). The fix introduces nf_ct_helper_expectfn_destroy(), which walks the expectation table and removes any expectations referencing the torn-down module after the RCU grace period, preventing use-after-free crashes.

The vulnerability can cause a kernel crash (denial of service) due to use-after-free when a NAT helper module is removed while expectations still exist. Exploitation requires CAP_SYS_MODULE privileges to unload the module, so it is primarily a robustness issue rather than a remote code execution or privilege escalation risk. No confidentiality or integrity impacts are reported.

A fix has been implemented in the Linux kernel to properly destroy stale expectations during NAT helper module unregistering, preventing use-after-free crashes. Users should update to a Linux kernel version that includes this fix. Since this requires kernel module unloading privileges, limiting CAP_SYS_MODULE access reduces risk. Patch status is not explicitly stated here; check the vendor or Linux kernel advisories for the fixed kernel versions and apply updates accordingly.