The vulnerability is a double‑free within the TEQL traffic‑control subsystem of the Linux kernel. When a TEQL device employs a lockless queue discipline as its root, calling qdisc_reset without using the seq_lock can race with the datapath, causing the kernel to double‑free a socket buffer. This leads to a kernel panic and a system crash, resulting in a denial of service on the affected host.

The issue resides in the Linux kernel’s TEQL implementation, which is used by all operating system distributions that ship a kernel with this feature enabled. Any kernel build that includes the TEQL qdisc and a lockless root qdisc is affected. No specific kernel release is listed, so all unpatched instances that include the unmodified TEQL source code are potentially vulnerable.

The CVSS score is not provided, but the severity is high because a kernel crash is catastrophic. No EPSS value or KEV listing is available, suggesting limited public exploitation data. Based on the description, the likely attack vector is an external party sending crafted packets to a host configured with TEQL, exploiting the race condition. The vulnerability requires precise timing but can be triggered by network traffic that exercises the TEQL path. No evidence of privilege escalation is provided; the main risk is disruption of availability.