The vulnerability in Linux’s packet scheduler occurs when the deficit round‑robin (DRR) quantum value is set to zero; the code falls back to a measurement function that lacks a floor. A crafted traffic packet length can cause the quantum to approach 2 GiB, making the scheduler’s deficit‑refill loop spin while holding a network‑device lock. This results in a denial‑of‑service condition that consumes CPU cycles and can stall networking or overall system responsiveness. The flaw is an example of uncontrolled resource consumption (CWE‑674).

All Linux kernels compiled with CONFIG_NET_SCH_DRR enabled are affected. The defect was present in all kernel versions prior to the commit that introduces a clamp on the quantum value; the patch is backported to the stable kernel, so newer kernels already include the fix. Systems that have not applied the update or that enable the DRR scheduler remain vulnerable.

The bug can be triggered only by an entity with CAP_NET_ADMIN (e.g., a local administrator or namespace‑level privileged user) by running a few commands to create a dummy interface and a DRR qdisc with an unsafe quantum. There is no evidence of a public exploit, and the vulnerability is not listed in the CISA KEV catalogue. The EPSS score is unavailable; however, the narrow attack surface and high impact suggest that the likelihood of exploitation is low, though a privileged insider could still cause a local denial of service through forced attachment of the problematic qdisc.