A flaw in the Linux kernel’s network scheduler allows a configuration of the act_gact or act_police actions with a control action value that bypasses the kernel’s range checks. Setting the special value TC_ACT_CONSUMED makes the kernel assume ownership of the packet skb, causing it to skip the freeing step for every packet that traverses the filter. This results in an unbounded leak of one sk_buff and its data buffer per packet, leading to rapid exhaustion of kernel memory and a denial of service. The weakness is a Boundary Value Manipulation (CWE‑911).

The issue is present in the Linux kernel’s net/sched subsystem before the patch that adds proper range validation. All versions prior to the patch are affected, including the 7.2‑rc6 release and older stable releases. No vendor‑specific version list is available beyond the generic Linux kernel code base.

The CVSS score is 5.5, reflecting a moderate severity due to memory exhaustion. The EPSS score is < 1%, indicating the expected exploitation probability is very low, but the deterministic nature of the leak gives a high chance of success if misconfiguration occurs. Based on the description, it is inferred that the attacker must have the ability to modify traffic‑control settings, typically requiring root or privileged access; this could also be leveraged indirectly by compromising services that adjust these filters. The vulnerability is not listed in CISA KEV.