The vulnerability originates from an unsafe concurrent modification of the global qdisc_rtab_list and its reference counter in the Linux kernel's traffic‑control subsystem. Without the RTNL mutex held, simultaneous calls to qdisc_get_rtab() and qdisc_put_rtab() form a race that can trigger a double‑free or use‑after‑free of the kmalloc‑2k qdisc_rate_table structure. This race belongs to CWE‑364 (Unsafe Concurrency). If exploited, the resulting memory corruption could crash the kernel or provide a foothold for privilege escalation.

Affected systems are any Linux kernel images in use, as the flaw is located in core networking code that exists in all distributions. No specific kernel version range is enumerated, so current and older kernels remain potentially vulnerable until the patch is applied.

The CVSS score of 7.8 suggests high severity, and the EPSS score of less than 1 % indicates a low but nonzero exploitation probability. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is a local attacker who can send RTM_NEWTFILTER netlink requests from the host and create a CPU‑level race by issuing concurrent traffic‑control filter commands with the TCA_ACT_FLAGS_NO_RTNL flag enabled.