The vulnerability originates in the Linux kernel qdisc subsystem, where the QFQ (Fair Queuing) scheduler incorrectly assumes that a class is active when its leaf queue length is non‑zero. When an inactive aggregate is deactivated, the code dereferences a NULL pointer in qfq_deactivate_agg, causing a kernel panic. This results in an operating system reboot and loss of availability, but no known privilege escalation or data breach capability is documented.

Affected vendor is Linux, specifically the Linux kernel. The issue is present in kernel 6.19 release candidates 1 through 4, and is likely present in subsequent 6.19 stable releases unless mitigated by later patches.

The CVSS score of 5.5 indicates a moderate severity and the EPSS of less than 1% suggests a low likelihood of exploitation at the time of this analysis. The vulnerability is not in the CISA KEV catalog. The attack likely requires the ability to manipulate traffic control settings or generate special packet flows that trigger the faulty reset path, which would normally require privileged access to system networking interfaces or kernel modules.