In the Linux kernel, the act_gate function in the traffic‑control subsystem can be replaced while a high‑resolution timer callback or dump routine is iterating over the scheduling list. The replacement converts parameters into an RCU‑protected snapshot and swaps them under tcf_lock, freeing the old snapshot with call_rcu(). When the REPLACE operation omits the entry list, the existing schedule is preserved but the race between the snapshot swap and the RCU cleanup can trigger a use‑after‑free or memory corruption. The identified weaknesses correspond to race conditions and use‑after‑free, and the flaw can lead to a kernel crash.

All Linux kernel releases that implement the act_gate network‑scheduler action are affected. In particular, the CPE identifiers list version 5.8 and the 7.0 release candidates (rc1, rc2) as well as any kernel version that matches the generic Linux kernel CPE. Thus, systems running kernel 5.8 or newer, including current production releases, may be vulnerable if they have not applied the patch that fixes this race condition.

The CVSS score of 7.8 indicates a high severity impact, while the EPSS score of less than 1 % suggests a low likelihood of exploitation in the wild. The flaw is not catalogued in CISA's KEV list. Exploitation would require local access with the ability to modify traffic‑control configurations or trigger a replacement of the gate action, which is typically restricted to privileged users. Consequently, the risk is primarily limited to availability of the host, with no known remote code execution vector.