In the Linux kernel’s traffic-control subsystem, the fq_codel scheduler incorrectly calls qdisc_tree_reduce_backlog during a packet peek before restoring the queue length. This premature backlog reduction can cause the parent class to think the queue is empty and deactivate the class even though packets remain queued, potentially leading to a wild memory access and kernel panic. The resulting denial of service manifests as a kernel crash and loss of network services. The vulnerability is a logic flaw that could allow an attacker to craft traffic that triggers the offending scenario, giving remote exploitability under network conditions that exercise the buggy code path.

All Linux kernel users that employ the fq_codel scheduler in their networking stack are affected, regardless of distribution. The exact kernel versions impacted are not enumerated in the advisory, so any build compiled with the current net/sched implementation prior to the identified commit is potentially vulnerable.

The flaw has a high impact score due to the criticality of a kernel crash, though the CVSS score is not supplied. EPSS data is unavailable, and the issue is not listed in CISA’s KEV catalog, suggesting no confirmed exploit yet. Nevertheless, the bug can be triggered via network packets that invoke the scheduler’s peek routine, implying that remote exploitation is possible if traffic can reach the vulnerable system. Given the severity of a kernel panic and the lack of immediate mitigations, administrators should treat this as a high‑risk vulnerability.