This vulnerability arises from the act_gate function in the Linux network scheduler. When the gate action is replaced while a high‑resolution timer callback or dump path is traversing the schedule list, the parameters are turned into an RCU‑protected snapshot and then swapped under tcf_lock. Because the previous snapshot is freed via call_rcu(), a race can occur that results in a use‑after‑free or memory corruption. An attacker who can control the replacement of the gate action may trigger this race, causing the kernel to crash. The weakness is associated with a race condition and use‑after‑free (CWE‑362, CWE‑416).

All Linux kernel releases that include the act_gate implementation of net/sched. The bug targets the core Linux kernel (vendor Linux, product Linux kernel). No specific version numbers are listed, so it may affect any kernel prior to the patch commit.

The CVSS score of 7.8 indicates significant impact. The EPSS score is below 1 %, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require local access and the ability to manipulate traffic‑control configurations. An attacker with such privileges could trigger a kernel panic, causing a denial of service. No remote code execution vector is documented, so the risk is primarily to availability of affected systems.