The vulnerability arises when the Linux kernel’s ETS (Ethernet Traffic Shaper) offload path calculates Weighted Round Robin (WRR) weights using unsigned 32‑bit integers for the q_sum and q_psum accumulators. These accumulators can overflow, leading to a division by zero during weight computation. The resulting divide error triggers a kernel panic, abruptly shutting down the operating system and causing system-wide denial of service. The weakness is an integer overflow that results in a division by zero (CWE‑190).

Linux kernel distributions that support ETS offloading are affected. The vulnerability was demonstrated on kernel 6.19.0 but the defect exists in any kernel version where the offload path still uses 32‑bit integers for q_sum and q_psum. No specific version range is listed, so all current kernels that expose the ETS qdisc configuration may be susceptible until the code change is applied.

The CVSS score of 5.5 indicates a moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, reinforcing its limited exploitation risk. An attacker would need to invoke the tc command to modify the ETS qdisc, typically requiring privileged access or a local code execution vector. Because the code paths are kernel internal, the exploit cannot be performed from unprivileged users and is subject to the kernel’s privilege model. Overall, the risk is moderate but the potential impact is critical if the theorem can be triggered on a production host.