diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
index a7b3f60dd0a8d7ea78d1e6a93f91764d5b56fa52..8cd12980bbde80cf3da35500100f7b1a938cb03f 100644
--- a/net/sched/act_ct.c
+++ b/net/sched/act_ct.c
@@ -1067,6 +1067,14 @@ TC_INDIRECT_SCOPE int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a,
 		 */
 		if (nf_conntrack_confirm(skb) != NF_ACCEPT)
 			goto drop;
+
+		/* The ct may be dropped if a clash has been resolved,
+		 * so it's necessary to retrieve it from skb again to
+		 * prevent UAF.
+		 */
+		ct = nf_ct_get(skb, &ctinfo);
+		if (!ct)
+			skip_add = true;
 	}
 
 	if (!skip_add)