The Linux kernel net/sched subsystem contains a flaw in the handling of error pointers returned by tcf_idr_delete_index(). During a delete action sequence, an unlocked classifier can interleave a reservation that returns ERR_PTR(-EBUSY). The code mistakenly treats that error pointer as a valid action structure, dereferencing tcfa_bindcnt and causing a null pointer dereference that results in a general protection fault and a kernel crash. This memory safety defect, identified as CWE-253, leads to denial of service by forcing a reboot.

The vulnerable code exists in the Linux kernel. No specific kernel release is listed in the CVE data, so any kernel version containing the pre‑fix tcf_idr_delete_index implementation may be impacted until the patch commit is incorporated.

The CVSS score of 7.0 indicates high severity while the EPSS score of less than 1% shows a low probability of exploitation in the near term. The vulnerability is not present in CISA’s KEV catalog, and no remote exploitation path is documented. The likely attack vector is local, requiring the attacker to influence traffic‑control actions to trigger the defective deletion sequence, which then causes a kernel panic and loss of availability.