The Linux kernel vulnerability CVE-2025-68206 affects the netfilter nft_ct module's handling of sequence adjustment for NATted FTP connections, specifically in PASV/EPSV modes. FTP control connections require rewriting IP and port information in the packet payload, which necessitates adjustments to TCP sequence and acknowledgment numbers. The vulnerability manifests when the conntrack helper is assigned after DNAT setup, causing the missing nfct_seqadj_ext_add() call and resulting in improper sequence adjustment. This leads to FTP NAT changes not working as expected, causing FTP sessions to fail with connection closures. The fix involves adding the required sequence adjustment extension when a conntrack helper is assigned to a connection with NAT bindings.

This vulnerability can cause denial of service for FTP clients using passive mode behind NAT, as FTP connections may be closed unexpectedly due to improper sequence adjustment. There is no indication of confidentiality or integrity impact. The CVSS vector indicates no confidentiality or integrity impact but a high impact on availability (denial of service). No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability has been resolved in the Linux kernel by adding the required sequence adjustment extension when a conntrack helper is assigned to a connection with NAT bindings. Users should monitor vendor advisories for kernel updates addressing this issue and apply official fixes once available. No alternative mitigations are specified.