The vulnerability in the Linux kernel's net/sched subsystem arises from a race condition in the tc_new_tfilter function where two threads concurrently create different filter types (u32 and flower) in the same chain and priority. This race leads to a locked classifier being destroyed without holding the rtnl_lock, resulting in a use-after-free condition. The issue was fixed by modifying tcf_proto_destroy() to acquire rtnl_lock around the destroy operation for locked classifiers when rtnl_lock is not already held, preventing unsafe destruction and eliminating the race.

This vulnerability can cause a use-after-free in the kernel's network scheduler, potentially leading to kernel crashes or memory corruption. The provided proof-of-concept triggered a KASAN slab-use-after-free error, indicating a serious memory safety issue. There is no information about active exploitation in the wild.

A fix is available that ensures rtnl_lock is held when destroying locked classifiers in the net/sched subsystem. Users should update their Linux kernel to a version that includes this fix. Since no vendor advisory or patch link is provided, check the official Linux kernel repositories or distributions for the patch corresponding to CVE-2026-74700.