In the Linux kernel, the act_ct classifier uses a flow table that is looked up via an RCU‑protected rhashtable. The code releases the RCU lock before incrementing the reference count. A race exists in which the table entry can be freed by cleanup work queued through call_rcu, so that the reference count is still incremented after the object has been freed. This causes a use‑after‑free that allows an attacker to execute arbitrary code in kernel mode. The flaw is a classic Use‑After‑Free (CWE‑826) and can lead to privilege escalation.

The vulnerability affects any Linux kernel that has act_ct enabled, which is common on systems that use the ‘tc’ traffic control classifier to match on connection‑tracking state. All distributions shipping a kernel with the net/sched act_ct implementation are potentially vulnerable until the upstream fix is backported. Devices such as routers or virtual machines that load the act_ct module for QoS or traffic shaping are also at risk.

Although the EPSS score is less than 1%, indicating a very low but non‑zero likelihood of exploitation, the CVSS score of 7.8 reflects a high severity due to kernel privilege escalation. The vulnerability is not listed in CISA’s KEV catalog. Achieving an exploit would still require a privileged or elevated context to trigger the race, and the small race window makes exploitation challenging, but the potential impact remains significant until a patch is deployed.