The vulnerability resides in the scx_bpf_dsq routines of the Linux kernel. When a deferred reenqueue operation runs on a destroyed DSQ, the kernel checks the DSQ identifier, reaches a BUG_ON condition, and panics. This defect, identified as CWE‑825, can abruptly interrupt system operation, resulting in a local denial‑of‑service.

All Linux kernel releases prior to the application of the published patch are affected. The issue is present in the core kernel regardless of distribution or version, but no specific kernel version boundaries were provided in the advisory.

The CVSS score of 4.1 indicates moderate severity, and the EPSS score is recorded as < 1 %, meaning exploitation probability is very low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector would require local or privileged access to trigger the DSQ deallocation before the deferred reenqueue executes. Successful exploitation would cause a kernel panic, leading to a system‑wide denial‑of‑service that requires a reboot or patch to recover.