A logic error in the Linux kernel’s traffic control scheduler causes the codel qdisc to invoke qdisc_tree_reduce_backlog before the queue length (qlen) has been restored. When qlen drops to zero while codel still holds a packet, the parent’s qlen_notify callback is mistakenly executed, deactivating the parent class. This mis‑state can trigger a wild memory access and a kernel Oops, crashing the system.

The flaw exists in the Linux kernel for any release that incorporates the codel traffic control scheduler and lacks the patch that repositions the qdisc_tree_reduce_backlog call. Any machine running an affected kernel version and enabling codel or qfq on a network interface is vulnerable. The product is the Linux kernel; the vendor is Linux.

The CVSS score of 9.8 indicates a critical vulnerability, while the EPSS score of < 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. While no public exploit is known, the kernel crash can lead to denial of service and may facilitate privilege escalation if the crash occurs in a privileged context. The attack vector likely requires an attacker to influence packet flow on the target system, such as by sending crafted traffic to an interface configured with codel/qfq.