The Linux kernel contains a race condition in the network queuing discipline (qdisc) subsystem that allows concurrent callers of qdisc_get_rtab() and qdisc_put_rtab() to mutate the global qdisc_rtab_list and a shared non‑atomic reference count without any locking. Historically the RTNL mutex protected these operations, but the introduction of the TCA_ACT_FLAGS_NO_RTNL flag in cls_flower removes that protection. Two simultaneous TCP netlink transactions that create flower filters with police actions can therefore corrupt the global list, causing a use‑after‑free or double‑free of the qdisc_rate_table structure. The resulting memory corruption is global and can be exploited by a local attacker as a kernel crash or as a foothold for arbitrary code execution, effectively elevating privileges.

All Linux kernel implementations, regardless of version, are impacted because the vulnerability exists in the core networking code. No specific kernel version range is provided in the CNA data, so any distribution using the default kernel should be considered vulnerable until an official fix is applied.

This bug lacks a CVSS score and EPSS data; however, the ability to corrupt kernel memory across all network namespaces indicates a severe risk profile. The exploit requires an attacker with local privileges capable of issuing RTM_NEWTFILTER netlink requests and the ability to time a race between two CPUs. While the exact exploitation steps are not detailed in the advisory, the nature of the flaw strongly suggests that a local attacker could achieve control over memory and potentially exploit additional vulnerabilities for full system compromise. The bug is not listed in the CISA KEV catalog, but due to its kernel‑level impact, system administrators should treat it as a high‑priority issue.