In the Linux kernel’s traffic control subsystem (net/sched), an error handling flaw caused the system to dereference an invalid error pointer during the destruction of a network namespace. This invalid dereference resulted in a kernel panic, disrupting system availability. The weakness is a null pointer dereference (CWE‑476).

The vulnerability affects Linux kernel releases that include the buggy net/sched code. Known affected builds are the 6.19 release candidates rc1, rc2, rc3, and rc4, as identified by the provided CPE entries. Earlier kernel versions that contain the same code path may also be vulnerable, but this is not explicitly confirmed in the advisory.

The CVSS score of 5.5 indicates medium severity, and the EPSS score is below 1%, with no listing in the CISA KEV catalog. The flaw is locally exploitable in the context of kernel operations that delete a network namespace, which typically requires administrative or privilege‑escalated access. An attacker would need to trigger a namespace teardown to cause the crash; remote triggering or code execution is not required. Overall, the risk is moderate, principally impacting system availability for users with sufficient privileges on affected kernel versions.