A race condition exists in the Linux kernel traffic control subsystem: the tcf_action_exec() routine checks the validity of a->goto_chain twice, once with rcu_access_pointer() and again with rcu_dereference_bh(), before dereferencing it. While executing a concurrent tcf_action_set_ctrlact() operation, a->goto_chain can be cleared between the two reads, causing the second read to return NULL. The function then dereferences this NULL pointer, leading to a kernel panic. This vulnerability could be exploited to crash the system, causing a denial of service. It does not directly expose data, but the crash can be used to disrupt services.

All Linux kernel versions that include the affected net/sched: act_api code where the tcf_action_exec() logic is present are potentially vulnerable. The specific kernel release identifiers are not enumerated in the advisory; users should verify whether their running kernel incorporates the change or update to a kernel version that includes the fix.

The EPSS score for this issue is not available, and it is not listed in the CISA KEV catalog. The risk is primarily local: an attacker would need to execute a command that triggers tcf_action_set_ctrlact() concurrently with an action that uses TC_ACT_GOTO_CHAIN. While the attack does not rely on remote network traffic, any privileged or vulnerable user that can manipulate traffic control configurations could coerce the race, leading to a crash. The CVSS score is not provided, but the impact—a kernel crash—demonstrates a high severity. Given that the vulnerability requires a specific race condition and has no known publicly available exploit, the immediate threat level is moderate, but the severity of the impact warrants prompt remediation.