The vulnerability arises when a traffic classification filter is moved to a different bucket. The route4_set_parms logic recomputes a handle that may differ, unlinking the filter from its original bucket but never freeing the now-empty bucket. This stale bucket remains in the head->table[] array, causing route4_delete to misreport a live filter and leave an empty tcf_proto object in memory. The unreferenced bucket creates a memory leak that can grow over time and lead to resource exhaustion.

Affected systems include any Linux kernel built with the networking classifier route4 configuration: CONFIG_NET_CLS_ROUTE4=y, CONFIG_NET_SCH_INGRESS=y, CONFIG_NET_CLS_ACT=y. The issue manifests when administrative users use the 'tc' utility to add, change, or delete ingress filters on devices such as lo. Thus, all Linux environments that enable these networking features and allow privileged filter modifications are vulnerable.

Because the bug is triggered by 'tc' commands that require root privileges, the attack vector is local privilege escalation or for users already with kernel modification rights. EPSS is < 1% and the vulnerability is not in the CISA KEV list, indicating limited public exploitation. However, an unpatched kernel may acculuctions of significant memory usage over time, ultimately impacting system availability. The CVSS score is 5.5, indicating moderate severity, but the potential for denial of service warrants prompt action.