The vulnerability involves a use‑after‑free condition in the clsact traffic‑control qdisc during its initialization and destruction phases. The affected code fails to correctly verify whether the ingress or egress sub‑structures were fully initialized before freeing them. This error can allow an attacker to trigger a kernel memory corruption that may lead to arbitrary code execution with kernel privileges. The weakness is identified as CWE‑416 (Use‑After‑Free).

This flaw resides in the Linux kernel and affects any distribution that includes the affected kernel code. No specific kernel versions are listed, so all releases prior to the fix commit should be considered vulnerable. The fix was introduced in commit 1cb6f0bae504, which is included in later kernel releases.

Although no CVSS or EPSS scores are provided, use‑after‑free conditions in kernel code typically carry a high severity rating. The flaw can be exploited by an attacker who can influence the clsact qdisc, for example, by configuring or manipulating the qdisc on a network interface. Successful exploitation could result in a complete compromise of the affected host. Since the flaw is not listed in the CISA KEV catalog and no EPSS data is available, the exact likelihood of exploitation remains unknown, but the potential impact warrants rapid remediation.