A flaw in the Linux kernel’s traffic‑control u32 filter causes the kernel to read memory beyond the bounds of a data structure. When the filter handler treats one node type as another, it accesses a non‑existent member and reads the class identifier value from an invalid address. This out‑of‑bounds read can leak kernel memory contents or cause a crash, potentially resulting in denial of service or information disclosure. The impact is dependent on the ability to manipulate traffic‑control rules, which typically requires elevated privileges. The flaw is categorized as a Buffer Overflow error (CWE‑805).

Linux kernel implementations across all distributions that ship the net/sched:cls_u32 code path are affected. No specific kernel version constraints are listed in the vendor metadata, so any release prior to the repository commit that introduced the fix is potentially vulnerable. Administrators should verify the running kernel version against the patch commit history to determine if remediation is required.

The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog, so there is no evidence of current exploitation. The vulnerability involves an out‑of‑bounds read (CWE‑805), which carries a moderate risk of causing a kernel crash or leaking data to a privileged attacker. The attack vector is inferred to be local or requires privileged manipulation of traffic‑control filters, as normal network traffic does not directly trigger the faulty code path. The CVSS score of 7.8 indicates high severity, underscoring the need for timely patching to prevent potential denial of service or information disclosure.