The act_ct classifier in the Linux kernel has a use‑after‑free bug that can be triggered when it consumes a packet still protected by the defragmentation engine. The kernel may later dereference this packet’s socket buffer, leading to a crash. This memory corruption causes denial of service and can give a privileged attacker a foothold for further exploitation.

The vulnerability resides in the Linux kernel and affects any system running a kernel version that contains the original act_ct implementation before the fix. All kernels before the patch that allows act_ct to bind only to clsact or ingress qdiscs are vulnerable, irrespective of vendor or distribution.

With a CVSS score of 7.8, the flaw is high severity, but the EPSS score is below 1%, indicating a low probability of exploitation in practice. It is not cataloged in CISA’s KEV list. Exploitation requires an attacker with local or privileged access able to configure networking classes, making this risk most pertinent to administrators who deploy act_ct in egress paths.