Linux CVE-2025-39764

The vulnerability exists in the Linux kernel's netfilter conntrack subsystem, specifically in the expectation dumper functionality (net/netfilter/nf_conntrack_netlink.c). The root cause is improper reference counting logic when resuming netlink dumps of expectation objects. When the kernel executes the refcount_inc_not_zero() operation to keep an expectation object alive across dump operations, a race condition occurs where the last dumped expectation (exp == last) can be incremented twice, causing the refcount to become inconsistent and preventing proper object deallocation. This mirrors a previously patched issue in the conntrack dumper itself. The affected CPE is cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* with explicit confirmation for Linux kernel 6.17-rc1. The issue is a resource management error (CWE class not specified in input, but indicative of use-after-free or double-free patterns).