The flaw resides in the Linux kernel’s networking scheduling module, specifically in how sch_multiq dequeues packets from child disciplines. The code originally performed a direct dequeue after peeking, which mismanages a stored sk_buff when the child is non‑work‑conserving. This results in an orphaned packet stash and a subsequent NULL dereference during a softirq while processing normal egress traffic, causing the kernel to panic. The effect is an instantaneous system crash that brings the host offline, exposing a severe availability breach. The vulnerability stems from a NULL pointer dereference (CWE‑476).

The affected product is the Linux kernel across all distributions that have not incorporated the commit removing the direct dequeue in sch_multiq. No specific kernel versions are listed, so any kernel predating the patch is potentially vulnerable. Users running custom kernels or older stable releases that have not yet been updated are included in the risk scope.

The CVSS score of 7.8 classifies this as a high severity vulnerability. The EPSS score is reported as <1%, indicating a low likelihood of exploitation at discovery time, and the vulnerability is not listed in the CISA KEV catalog, so no known widespread exploits exist. However, the crash can be triggered by traffic that forces the kernel to route packets through the affected queue disciplines, a behavior that is inferred from the description. Because the outage is total and immediate, the risk remains high for any system that cannot be patched promptly.