The DualPI2 scheduler in the Linux kernel calculates GSO packet segments incorrectly, causing the queue length counter of its parent to increase beyond the actual number of queued packets. When the scheduler later removes packets from an empty parent queue, it dereferences a null pointer, leading to a kernel panic that stops the system. This denial‑of‑service flaw is triggered by the delivery of oversized GSO packets.

All Linux kernel builds that include the DualPI2 scheduler and its dependent QFQ parent without the recent fix commit are vulnerable. Any interface configured to use GSO segmentation while running an unpatched version of the kernel is at risk.

The CVSS score of 5.5 marks the vulnerability as medium severity. Its EPSS score is below 1%, and it is not listed in the CISA KEV catalog, indicating a low probability of widespread exploitation. An attacker could trigger the crash by sending crafted GSO traffic to a publicly exposed interface that uses the vulnerable scheduler, but no public exploit has been reported.