This vulnerability is a NULL pointer dereference in the Linux kernel’s TAPRIO traffic‑control qdisc. When a TAPRIO child qdisc is deleted, the kernel stores a NULL in the qdisc array. A subsequent class dump then dereferences that NULL, causing the kernel to panic. The flaw is reachable with CAP_NET_ADMIN, and on systems that allow unprivileged network namespaces, a local user can trigger the crash by creating a TAPRIO qdisc, deleting it, and requesting a class dump. The underlying weakness is a classic NULL pointer dereference (CWE‑476). The impact is a loss of operating system availability because a kernel panic forces the host to reboot or become unusable.

The issue affects any Linux kernel that has the CONFIG_NET_SCH_TAPRIO configuration enabled. No specific kernel version is listed in the advisory, so the vulnerability may exist in any affected release that has not incorporated the recent patch commits. Both vendor and build variants of the Linux kernel are subject to the flaw.

The exploitability does not require network connectivity; it can be performed locally with sufficient capabilities, or by an unprivileged user when user namespaces are enabled. The CVSS score is not provided, but the known kernel panic indicates a high‑severity privacy and availability problem. The EPSS score is not available and the vulnerability is not currently listed in the CISA KEV catalog. Attackers must have the ability to add or manipulate qdiscs via the netlink interface, which typically requires CAP_NET_ADMIN or privileged namespaces. Once the attacker is able to trigger the dump operation, the kernel will crash, resulting in a denial of service.