The vulnerability resides in the Linux kernel’s traffic control hhf qdisc. The hhf_change() function accepts a quantum value from userspace without imposing a lower bound. A quantum of 1, combined with a size table that can grow to approximately 2 GiB, causes the deficit‑refill loop to spin around 2^31 iterations while holding the qdisc lock. This results in a soft lockup and effectively a denial of service. The flaw is triggered via the quantum parameter exposed to tc commands and requires CAP_NET_ADMIN privileges. The impact is an interruption of packet scheduling that can stall kernel threads.

Linux kernel systems configured with CONFIG_NET_SCH_HHF=yes are affected. The flaw exists in any kernel version that lacks the recent fix, which clamped the quantum to a minimum of 256 and limited hhf_init to a range of [256, 1<<20]. There is no vendor‑specific version information provided; any distribution shipping a kernel with hhf enabled can be impacted.

The CVSS score is not listed, but the EPSS score is unavailable and the issue is not in the CISA KEV catalog. Nevertheless, the vulnerability is exploitable by any entity that can achieve CAP_NET_ADMIN in the target namespace—typically root or users granted that capability. The attack surface is local and requires administrative privileges, yet the effect—a kernel‑level soft lockup that can halt system responsiveness—requires no network connection or external trigger. The lack of a public exploit does not diminish the risk, as the conditions are straightforward to satisfy with known tc utilities. Because the affected code paths are exercised only when the hhf qdisc is present, mitigation can be applied by disabling or patching the qdisc.