The defect lies in the qfq_change_class() routine of the Linux kernel’s QFQ traffic scheduler. When a requested reallocation of a class or its underlying qdisc fails, the code frees both cl->qdisc and cl regardless of the failure, leaving dangling pointers. This improper deallocation would trigger a use‑after‑free (UAF) condition if the freed memory is subsequently reused in the kernel, potentially leading to a crash or, in a more elaborate scenario, arbitrary code execution within the kernel context.

The flaw affects all Linux kernel builds that bundle the QFQ scheduler and have not yet incorporated the patch, notably the 6.19 release candidates rc1 through rc5 and any derivative kernels that ship with the default QFQ configuration. All operating systems produced under the Linux:Linux CNA designation that use these kernel versions are therefore impacted.

The CVSS score of 5.5 classifies the vulnerability as moderate, and the EPSS of less than 1% indicates a low probability that attackers will target this flaw in the wild. It is not listed in the CISA KEV catalog. The vulnerability can be exploited if an attacker can influence network class allocations, but the likely attack vector is local manipulation of traffic class assignments on a compromised or privileged host, as inferred from the nature of the code path. Remote exploitation without such foothold is not directly supported by the CVE description.