The vulnerability in Linux’s packet scheduler occurs when the deficit round‑robin (DRR) quantum value is set to zero; the code falls back to a measurement function that lacks a floor. A crafted traffic packet length can cause the quantum to approach 2 GiB, making the scheduler’s deficit‑refill loop spin while holding a network‑device lock. This results in a denial‑of‑service condition that consumes CPU cycles and can stall networking or overall system responsiveness. The flaw illustrates a race condition (CWE‑835).

All Linux kernels compiled with CONFIG_NET_SCH_DRR enabled are affected. The defect was present in all kernel versions prior to the commit that clamps the quantum value; after the commit, the vulnerability is fixed.

The bug can be triggered only by an entity with CAP_NET_ADMIN (e.g., a local administrator or namespace‑level privileged user) by running a few commands to create a dummy interface and a DRR qdisc with an unsafe quantum. There is no evidence of a public exploit, and the vulnerability is not listed in the CISA KEV catalogue. The CVSS score of 5.5 indicates moderate severity, and the EPSS score of <1% indicates a very low exploitation probability. The narrow attack surface and high impact suggest that the likelihood of exploitation is low, though a privileged insider could cause a local denial of service through forced attachment of the problematic qdisc.