Use-after-free in the Linux kernel's net/sched cls_api when handling TC_ACT_CONSUMED in tcf_qevent_handle can allow remote code execution. The flaw is triggered if a RED qdisc is configured with a qevent early_drop and a tc filter using connection tracking (act_ct) with defragmentation enabled while receiving out-of-order fragments. No active exploitation or public PoC exists; EPSS score 0.17% indicates low exploitation probability despite a CVSS 9.8 base score.
Information Disclosure
Linux
NVD
VulDB
CVSS 3.1
9.8
EPSS
0.2%