In the Linux kernel’s traffic‑control subsystem, the action execution code performs a two‑step check of the goto_chain pointer: an RCU access-pointer check followed by an independent RCU dereference and subsequent dereference of the chain. During concurrent modification of the same action, the second read can return NULL while the first succeeded, leading to a null dereference that crashes the kernel. This is a time‑of‑check‑to‑time‑of‑use race that results in a null dereference (CWE‑476). The crash stops the kernel, causing a denial of service.

All Linux kernel releases containing the vulnerable net/sched: act_api code prior to applying the commit that merges a single rcu_dereference_bh() check are potentially affected. The advisory does not list specific release identifiers; users should determine whether their running kernel includes the commit referenced in the patch series.

The CVSS score of 5.5 indicates medium overall severity, while the EPSS score of < 1% and absence from the CISA KEV catalog suggest very low current exploitation activity. The vulnerability requires a timing‑dependent race between executing and modifying a traffic‑control action, and no publicly available exploit is documented. Consequently, the risk level is moderate, but the potential for system downtime warrants timely remediation.