The Linux kernel’s traffic‑control classifier for flow shaping can fall back to an address‑folding routine when packet header fields are missing. In map mode, user space controls parameters such as mask, xor, rshift, addend, and divisor, and can read the resulting class ID. By examining class statistics, an attacker inside a user or network namespace can recover the 32‑bit folded value of kernel pointers such as skb->sk, skb_dst(), or skb_nfct(). This leakage exposes internal memory addresses that may be useful in subsequent kernel attacks.

Affected systems are Linux distributions running the Linux kernel. No specific kernel versions were listed in the CNA data; any system that has not yet incorporated the referenced commits is vulnerable.

The CVSS score is 5.5. The flaw is an information‑exposure vulnerability. Exploitation requires the ability to execute traffic‑control commands in the same user or network namespace as the target, which local users typically have. The EPSS score of less than 1% indicates a low probability of active exploitation, and the vulnerability is not listed in CISA KEV, so active exploitation is uncertain. Based on the description, it is inferred that the leaked addresses could aid attackers in crafting subsequent privilege‑escalation exploits that rely on known kernel addresses. The overall risk is moderate, with no immediate denial‑of‑service or privilege‑escalation effect on its own.