A critical use-after-free vulnerability in the Linux kernel network scheduler could allow an attacker to cause system instability or execute arbitrary code.

The vulnerability exists in the tcf_qevent_handle function within the network scheduler API. The function fails to handle TC_ACT_CONSUMED return values correctly, leading to a use-after-free condition when the kernel attempts to operate on a socket buffer that is no longer owned by the caller.

This vulnerability carries a CVSS score of 9.8, indicating a critical risk to system integrity, confidentiality, and availability. Successful exploitation could lead to kernel panics, denial of service, or potentially privilege escalation, which would significantly disrupt business operations and compromise sensitive data stored on the affected server.

Immediate Action: Update the Linux kernel to the versions specified in the enrichment data: 5.15.212, 6.1.178, 6.6.145, or 6.12.97 or later.

Proactive Monitoring: Monitor system logs for kernel oops or crash reports that coincide with network traffic anomalies.

Compensating Controls: Restrict access to network configuration tools and limit the ability of non-privileged users to interact with traffic control (tc) sub-systems.

Public Exploit Available: Unknown.

Given the critical nature of kernel-level vulnerabilities, organizations should prioritize patching affected Linux distributions as part of their next maintenance cycle. Ensure that all production kernels are updated to the latest stable versions to mitigate the risk of local exploitation.