A race condition arises when the Linux kernel concurrently processes NEWTFILTER and DELFILTER operations in the traffic‑control (tc) subsystem. While an action structure is held under a mutex, another CPU may decrement its reference count and remove it from the IDR, immediately freeing the structure. The first CPU then attempts to increment the reference count on the already freed pointer, resulting in a use‑after‑free. The patch introduces an RCU‑based deferred free to eliminate the race. This flaw is a classic use‑after‑free (CWE‑416) that can lead to kernel memory corruption.

The vulnerability affects all Linux kernel versions that include the traffic‑control scheduling subsystem and have not yet applied the RCU‑deferral commit. It is not tied to a specific vendor edition; any kernel build that supports tc filters is potentially affected when the patch is absent.

No CVSS score or EPSS value is published, and the vulnerability is not listed in CISA’s KEV catalog, so public exploitation activity is unknown. The description indicates that a user with the ability to add or remove tc filters can trigger the race, so it is inferred that a local or privileged attacker can exploit the flaw. The potential for local privilege escalation or kernel compromise gives the risk a moderate to high weight for systems where traffic‑control configuration is available.