A null pointer dereference in the Linux kernel’s traffic control subsystem occurs when the red qdisc incorrectly invokes its child’s dequeue method directly after a peek operation. The bug triggers a kernel panic and disrupts all system operations. The weakness is a classic null pointer dereference, corresponding to CWE‑476. The vulnerability is limited to the scheduler component and does not directly expose data or execute arbitrary code.

The flaw resides in the Linux kernel’s network scheduling code (sch_red). All kernels that contain the unpatched sch_red implementation are vulnerable until the upstream patch that replaces the direct dequeue call with the safer qdisc_dequeue_peeked() method is applied. The affected product is the Linux operating system kernel, specifically the network traffic control stack.

The kernel crash makes this a high‑risk denial of service flaw. The EPSS score is not available and the vulnerability is not listed in CISA KEV, indicating that widespread exploitation may not yet be observed. The likely attack vector is remote, network‑based, as the bug is triggered by crafted packets that exercise the problematic qdisc path; this inference is based on the nature of the component, but the description does not explicitly state the attack entry point. Attackers with network access could trigger the panic by sending packets that cause the red qdisc to process child queues containing a null pointer. Consequently, a timely patch or mitigations are recommended.