The flaw resides in the Linux kernel's dualpi2 traffic control module. The change handler failed to verify the return value when dequeuing packets from the L‑queue after the C‑queue was empty, resulting in a NULL pointer dereference during backlog or memory limit enforcement. This kernel panic immediately brings the system down, abruptly halting network services.

All Linux kernel installations that lack the commit 3042add80c2c50bd127d570b83319af612efde65 or later are vulnerable. The weakness affects the dualpi2 qdisc across all kernel families, regardless of configuration, and can be triggered on any system that still uses this kernel version.

Because a NULL pointer dereference at kernel level causes a crash, the risk is high. Exploitation requires triggering a configuration change or traffic scenario that causes dualpi2_change() to run under the vulnerable condition. The attack vector is inferred to be local or remote network traffic that modifies qdisc settings or classifies packets such that the L‑queue is populated while the C‑queue remains empty. No EPSS score is available and the vulnerability is not listed in CISA KEV, but the potential for a kernel panic creates a critical threat to availability.