A TOCTOU race condition in the Linux kernel’s act_pedit network scheduler allows an attacker with CAP_NET_ADMIN privilege to size a flow_rule buffer and then, before the buffer is populated, write 4 bytes beyond the allocated 288‑byte region. The out‑of‑bounds write is reported by KASAN as a slab-out-of-bounds error adjacent to the allocated region. This memory corruption could alter kernel data structures, potentially compromising system confidentiality, integrity, or availability.

All Linux kernel versions that do not include the act_pedit TOCTOU heap OOB fix are affected. The vulnerability resides in the tc act_pedit component of the Linux kernel, and any distribution shipping an older kernel will be vulnerable unless patched.

The CVSS score of 7.8 classifies the issue as high severity, while the EPSS score of <1% indicates a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Exploitation requires CAP_NET_ADMIN, limiting the attack to privileged local users and reducing the potential impact to environments where such privileges are tightly controlled. Despite the low EPSS, the race condition is reachable in practice and could be used to overwrite kernel memory, making it a concern for systems with untrusted privileged users.