The vulnerability arises in the net/sched act_ct classifier when the RCU read lock is released before the reference counter is safely incremented on a flow‑table entry. A race condition allows the cleanup routine to free the object between the lock release and the ref‑count increment, resulting in a use‑after‑free that can be exploited to run arbitrary code with kernel privileges. The weakness is typical of concurrent memory‑management bugs and directly leads to local privilege escalation.

All Linux kernel versions that ship the act_ct module or include it in the traffic‑control package are affected. The flaw applies to both built‑in and loadable act_ct modules. Any Linux system configured to use act_ct for traffic‑control will be impacted.

The vulnerability carries a CVSS score of 7.8 indicating high severity. Its EPSS score of less than 1% denotes an extremely low exploitation probability, and it is not listed in the CISA KEV catalog. The race window is short, making successful exploitation difficult; a local or privileged attacker who can influence act_ct processing and observe timing may achieve the UAF. Remote exploitation without local access is unlikely; the primary threat vector is a local adversary who can trigger traffic‑control operations.