A use‑after‑free flaw in the Linux kernel networking scheduler API triggers when the classification routine returns TC_ACT_CONSUMED while a packet buffer remains owned by the defragmentation engine. The event handler incorrectly treats the buffer as still owned and returns it to the caller, leading to a use‑after‑free. This vulnerability is identified as CWE‑825 and can enable an attacker to corrupt kernel memory and potentially execute arbitrary code with elevated privileges.

The vulnerability affects all Linux kernel installations that support the traffic control qdisc RED with connection tracking defragmentation enabled. It is present in kernels before the patch that handles TC_ACT_CONSUMED correctly, regardless of distribution or version; any system running the affected kernel should be considered at risk.

With a CVSS score of 9.8 the flaw is classified as critical. Although the EPSS score is below 1% and it is not currently listed in CISA’s KEV catalog, the combination of kernel privileges and a use‑after‑free attack path could allow local or remote attackers that can influence network traffic to execute code at kernel level. The attack likely requires sending crafted fragmented packets to a device that uses RED qdisc while connection tracking defrag is enabled; once triggered, the flaw causes a kernel crash or memory corruption.