The vulnerability resides in the Linux kernel’s traffic‑shaping qdisc, sch_teql, where concurrent updates to the master->slaves singly linked list are performed without proper locking or RCU protection. This race condition leads to a slab‑use‑after‑free, a classic CWE-825 (synchronization) flaw, when teql_master_xmit() accesses a stale pointer after the master qdisc has been freed. An attacker with local access that can invoke traffic‑shaping operations can trigger this flaw, causing execution of arbitrary code in kernel context and enabling local privilege escalation.

All Linux kernel releases that include the unpatched sch_teql Qdisc are potentially impacted. The advisory lists vendor entries as Linux:Linux with no specific version ranges, implying that any kernel implementing the original unprotected list, prior to the slaves_lock and RCU fix, could be vulnerable.

The CVSS score of 7.8 marks the issue as high severity, while an EPSS score of less than 1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploit yet. The most probable attack vector is local, requiring an attacker to trigger qdisc operations while the kernel is servicing traffic on multiple CPUs; successful exploitation could lead to kernel corruption and privilege escalation.