In the Linux kernel, the ETS (Enhanced Transmission Selection) qdisc implementation incorrectly handles the quantum value when it is not explicitly configured. If a user creates an ETS qdisc with a zero quantum, the internal logic falls back to a zero psched_mtu, causing the deficit‑refill algorithm to spin indefinitely while holding the qdisc lock. This infinite loop consumes CPU cycles and can deny service to all packets processed by that qdisc. The weakness is related to improper handling of default values leading to a denial‑of‑service condition.

The vulnerability affects Linux kernels compiled with the NET_SCH_ETS configuration option enabled. Any distribution using an unpatched kernel where an ETS qdisc can be added by a user who has CAP_NET_ADMIN privileges is potentially exposed. The patch that moves the clamping logic into the quantum parsing code protects against this issue, but the exact first affected kernel version is not listed in the provided data.

Because the exploit requires administrative privileges on the host and the ability to execute tc commands in the same network namespace, it is limited to users with CAP_NET_ADMIN. The CVSS score is 5.5, and the EPSS score is below 1%, indicating a relatively low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. However, the impact of a successful exploit is a denial of service that could affect system availability, so the risk remains high for exposed environments.