The Linux kernel’s traffic‑control subsystem contains a logic flaw in the fq_codel scheduler. During a packet peek operation, it calls qdisc_tree_reduce_backlog before restoring the queue length counter. If the queue length becomes zero while a packet is still present, the parent class is incorrectly notified of an empty queue, leading to a deactivation of the class and a wild memory access that can result in a kernel crash or panic.

All Linux kernel distributions that compile the latest net/sched implementation with the fq_codel scheduler are potentially affected. The advisory does not enumerate specific kernel versions, so any kernel build prior to the commit that fixes the issue is vulnerable. System administrators should consider any system running a kernel that does not include the fix to be at risk.

The bug can be triggered by network traffic that engages the fq_codel scheduler’s peek mechanism, making remote exploitation theoretically possible. With a CVSS score of 9.8 and an EPSS of < 1%, the vulnerability is high severity yet has a very low probability of exploitation and is not listed in CISA’s KEV catalog. The potential impact remains a kernel panic that halts network services and may affect overall system availability.