In the Linux kernel, the classification routine can return TC_ACT_CONSUMED while the socket buffer is still under the defragmentation engine's control. The tcf_qevent_handle function does not treat this return value specially and passes the buffer back to the caller as if the packet had been processed normally. Because the buffer is no longer owned by the caller, this produces a use‑after‑free condition that can corrupt kernel memory. The flaw is cataloged as CWE‑416 and CWE‑825.

All Linux kernel deployments that enable the RED traffic control qdisc with connection‑tracking defragmentation on any network interface are affected. The vulnerability applies to every kernel version released before the patch that adds proper handling for TC_ACT_CONSUMED; no specific version range is provided in the CVE record.

The flaw carries a CVSS score of 9.8, placing it in the critical range, while its EPSS score is below 1% and it is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to deliver crafted fragmented traffic over a network interface configured with RED qdisc and CT defrag, which may be achievable remotely from any host that can send packets to the target. If triggered, the use‑after‑free can lead to kernel memory corruption, potentially allowing an attacker to execute arbitrary code with kernel privileges.