The vulnerability is a null‑pointer dereference (CWE‑476) in the Linux kernel’s network scheduling subsystem. When a parent queuing discipline calls a child’s dequeue operation immediately after a peek, the child can dereference a null pointer, causing a kernel panic. The crash terminates the kernel, resulting in a denial of service for all processes on the host.

Affected are Linux kernel operating systems built from the Linux source before the commit that replaces the direct dequeue call with a peek and qdisc_dequeue_peeked, particularly those that compile the net/sched scheduler with the tbf, sfb, qfq queuing disciplines. No released kernel version information is available, so any kernel compiled from the upstream tree prior to that change may be vulnerable.

Based on the description, the attack vector likely involves sending crafted network traffic through a queuing discipline hierarchy to trigger the bug, implying network or local access is needed. The flaw requires a specific queuing hierarchy and network traffic that triggers the dequeue sequence, so it is not trivially exploitable from arbitrary configurations. An attacker with network or local access who can send crafted traffic to a device configured with the vulnerable qdisc setup could crash the system. The EPSS score indicates a very low probability of exploitation, and the vulnerability is not currently listed in CISA’s KEV catalog. The CVSS score is 5.5, indicating moderate severity. Consequently the risk is moderate in terms of impact but low in terms of likelihood, especially if the system does not use the vulnerable qdisc configuration.