The bug in the netem enqueue logic meant that reordered packets were not counted against the scheduler's queue limit. As a result, the queue could grow beyond its intended bound, potentially consuming excessive kernel memory and degrading system performance or causing a denial of service. The flaw is a logical oversight in the size check rather than an injection or memory corruption bug.

All Linux kernel versions that include the netem qdisc and have not received the commit that corrects the queue limit check are affected. The kernel is distributed by all major Linux vendors. The fix is documented in the upstream commit history.

Given that the vulnerability requires network traffic that triggers packet reordering, an attacker could send crafted traffic to a host running the affected kernel to flood its traffic shaping queue. There is no direct code execution path, but a sustained attack could exhaust kernel resources. The CVSS score is not provided, and EPSS data is unavailable; the issue is not listed in CISA’s KEV catalog, suggesting limited public exploitation. Nonetheless, the risk is sufficient to warrant patching.