The Linux kernel’s network scheduler suffered a memory leak caused by deferred queue discipline (qdisc) drops. When the root qdisc does not implement the TCQ_F_DEQUEUE_DROPS flag, packets queued for dropping are never freed and accumulate in a child list, inflating kernel memory usage. This uncontrolled growth can exhaust available memory, leading to system slowdown or crash. The weakness is a classic resource leak (CWE‑401).

All Linux kernel implementations prior to the application of the fix are potentially affected, and this includes the kernel distribution shipped with most Linux‑based operating systems. No specific version range is listed, so any kernel that received the patch is not affected.

The CVSS score is unavailable, and the EPSS score is unspecified. Based on the description, it can be inferred that an attacker could trigger the memory leak by generating high‑volume traffic that causes packets to be queued for deferred drops. The likely attack vector is network traffic directed at a vulnerable device, using crafted or excessive packets to activate the de‑queuing pathway. However, no evidence of successful exploitation exists; this assessment is inferred from the reported behavior. Although the vulnerability is not listed in the CISA KEV catalog, the potential for kernel memory exhaustion makes it a moderate to high risk for hosts handling large network loads, such as routers or servers.