The clsact traffic control qdisc contains a use‑after‑free bug that is triggered when a qdisc instance is only partially initialized and then destroyed during a rollback of a failed replacement. The bug occurs because the destroy callback checks for non‑NULL ingress and egress entries, but an incomplete initialization can leave a valid egress entry from a previous instance. Dereferencing this freed memory can cause the kernel to crash, resulting in a denial of service. The weakness is a memory safety issue (CWE‑911).

All Linux kernel builds released before the inclusion of commit 1cb6f0bae504 are vulnerable. The CVE data does not specify a version range, so any kernel that does not contain the clsact patch should be considered affected.

The CVSS v3 score of 5.5 indicates moderate severity, and the EPSS score of less than 1 % shows a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attack requires an ability to provoke a qdisc initialization failure or to configure traffic control rules, which normally demands elevated privileges; thus remote exploitation is unlikely and the risk is primarily local or privileged.