The bug in the Linux kernel’s DualPI2 scheduler miscounts the number of GSO segments, causing the parent queue length to exceed the actual number of queued packets. When no real packets remain, the scheduler still reports a non‑zero queue length, leading to a NULL pointer dereference during dequeuing. This results in a kernel crash, providing a clear denial‑of‑service avenue.

Linux kernels that include the DualPI2 net/sched scheduler and have not been updated with the fix commit (05ed733b65ab977dd931e7f7ac0f62fdb81205c2) are affected. The CVE does not specify exact version ranges, implying that all releases containing the unpatched code are vulnerable.

The vulnerability carries a high impact due to the fatal kernel panic it triggers. No quantified CVSS score is available, but the EPSS score is <1% (approximately 0.00155), and the issue is not listed in CISA’s KEV catalog. The likely attack vector is the delivery of oversized GSO packets to the target, which can be performed remotely if DualPI2 (or a dependent QFQ parent) is enabled on exposed network interfaces. Although no public exploit is documented, the mechanics of the bug mean that an attacker could readily trigger it by sending crafted traffic, making the risk moderate to high for affected systems.