A race condition in the Linux kernel’s act_tunnel_key routine allows an attacker to free destination metadata while a reader still holds a reference to it. The freed metadata can then be accessed through dst_clone, triggering a use‑after‑free that corrupts kernel memory. This memory corruption can cause a kernel crash or potentially be leveraged by a local attacker to execute arbitrary code in kernel mode.

The vulnerability affects all Linux kernel versions that include the act_tunnel_key module in the net/sched subsystem. No specific vendor or version list is provided, so the risk applies to any current or custom kernel build that has not incorporated the commit that defers dst_release to an RCU callback.

The CVSS score of 7.8 indicates a medium‑to‑high severity, while the EPSS score of less than 1 % suggests a low likelihood of exploitation. The flaw is not listed in CISA KEV. Exploitation would require local access and the ability to trigger the tunnel_key action path. Though no public exploit exists, kernel KASAN reports confirm the use‑after‑free, implying that the vulnerability is real and could result in memory corruption if exploited.