The vulnerability is a race condition in the Linux kernel’s traffic control subsystem. An RTM_NEWQDISC request with an invalid TCA_RATE can cause a queued classifier (clsact) to bind a populated shared ingress block during initialization, and if the creation fails later, the cleanup removes the pointer but frees the containing qdisc while other kernel threads still reference it. Use‑after‑free can corrupt kernel memory and, if the attacker can invoke the interface, may lead to arbitrary code execution with kernel privileges. It is inferred that successful exploitation requires privileged access to the RTM_NEWQDISC interface, which is normally restricted to root or administrator users.

All Linux kernel versions prior to the commit that defers qdisc freeing are susceptible. The flaw affects the core kernel, so every distribution containing those releases is impacted until the patch is applied.

The CVSS score of 7.8 indicates a high severity threat. The EPSS score of <1% suggests a low probability of external exploitation. The vulnerability is not listed in the CISA KEV catalog, so no confirmed active exploitation is known. It is inferred that the likely attack vector is exploiting the RTM_NEWQDISC interface with privileged access, which is normally restricted to root or administrator users; if an attacker with sufficient privileges can trigger the request during a race, they could achieve kernel‑level execution through memory corruption.