In the Linux kernel, the taprio traffic‑control qdisc incorrectly handled packet dequeueing after peeking its child qdisc. The child stored a peeked packet in a reserved buffer, but a subsequent direct dequeue call ignored that buffer, orphaning the packet and desynchronizing the child’s queue. When the child was a qfq qdisc, this path re‑entered the child on an empty list and dereferenced a null pointer, causing a kernel panic while processing softirq traffic. The flaw allows an attacker to trigger a fatal crash by sending crafted traffic to a taprio‑enabled interface, resulting in a denial‑of‑service of the entire host. The underlying weakness is a null pointer dereference (CWE‑476).

The flaw affects all Linux kernel releases that include the taprio qdisc path before the applied patch. The patch is incorporated in newer kernel versions, but specific affected version ranges are not provided in the advisory. Systems running a vulnerable kernel and using the taprio qdisc on any network interface are at risk.

The CVSS score of 8.2 and the EPSS score of less than 1% indicate a high severity yet low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Nonetheless, a kernel panic is a severe impact. The likely attack vector is network traffic directed at taprio‑configured interfaces, which is entirely remote. While no public exploitation reports exist, the absence of exploitation data does not mitigate the potential for an attacker to trigger a crash by sending crafted packets to an affected host.