The defect in the Linux kernel’s sch_dualpi2 traffic shaper triggers a null‑pointer dereference when a packet is discarded during the peek operation before the queue length is restored, leading to an abrupt KASAN‑reported kernel panic that can crash the system. This occurs because the scheduler calls qdisc_tree_reduce_backlog before resetting the queue length, causing the parent class to be mistakenly deactivated when packets remain in the queue. A kernel crash can result in denial of service and may interrupt critical services.

All Linux kernels that support the dualpi2 queue discipline are affected, across all distributions. The issue is present in the generic kernel tree and in any builds that enable dualpi2 without the patch changes referenced in the provided commit URLs. Version information is not supplied.

The EPSS score of <1% indicates a low likelihood of exploitation, and the vulnerability is not listed in CISA KEV, so the exact exploitation probability is low. Based on the description, the likely attack vector is via network traffic that triggers the dualpi2 scheduler’s drop logic during peek. A successful trigger results in a kernel panic, causing a denial of service that may affect any host running the vulnerable scheduler. No explicit evidence of privilege escalation is present, and exploitation would require the attacker’s traffic to reach the kernel’s packet scheduling layer, which can be achieved by remote network packets or local traffic on a compromised host. The CVSS score of 5.5 indicates a medium severity.