A logic flaw in the Linux kernel’s HFSC (Hierarchical Fair Service Curve) qdisc causes a packet class to be marked passive twice during dequeue. The double marking removes a parent class from its active tree, so remaining queued packets are never dequeued. The outcome is that affected traffic streams stall completely, effectively denying service to the interface or network flow using that scheduler. The issue maps to CWE-821 (Unreasonable Resource Consumption) due to the unintended active state transition and potential for resource exhaustion.

The issue is present in all Linux kernel builds that implement the HFSC qdisc, as indicated by the broad Linux kernel CPE and the lack of any version restriction in the advisory.

The CVSS score of 5.5 reflects moderate severity for this denial‑of‑service flaw. Based on the description, the attacker must generate traffic that is scheduled by HFSC in order to trigger the double passive marking. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, although the risk for targeted systems remains. No KEV listing is present, so it is not currently identified as a known exploited vulnerability. Once triggered, the stall can persist until the kernel is updated or the HFSC configuration is altered, providing a potential denial‑of‑service vector to systems that rely on HFSC for traffic shaping.