The flaw occurs in the net/sched act_ct classifier where an RCU read lock is released before the reference count is incremented on a flow table entry. The race between this release and the cleanup work that eventually frees the entry creates a use‑after‑free that can be abused to execute arbitrary code in kernel mode, allowing an attacker to gain root privileges. The weakness is a classic Use‑After‑Free and leads directly to local privilege escalation.

Any Linux kernel that has act_ct enabled is affected; this includes most distributions that ship an up‑to‑date kernel with the tc traffic‑control package. Devices such as routers, switches, virtual machines or embedded systems that use the act_ct classifier for QoS or connection‑tracking traffic shaping may also be at risk. The vulnerability applies to both the built‑in act_ct module and the loadable act_ct.ko module.

The CVSS score of 7.8 reflects high severity, while the EPSS score of less than 1% indicates an extremely low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. The race window is very short, making successful exploitation difficult; however, a privileged or local attacker who can trigger act_ct processing and influence the timing of kernel events could potentially abuse the UAF to elevate privileges. Because the vulnerability requires tapping into the kernel’s re‑reference mechanisms, a remote attacker without local access is unlikely to succeed, but a local or compromised user is a credible threat vector.