The vulnerability resides in the Linux kernel’s traffic control hhf qdisc. The hhf_change() function accepts a quantum value from userspace without imposing a lower bound. A quantum of 1, combined with a size table that can grow to approximately 2 GiB, causes the deficit‑refill loop to spin around 2^31 iterations while holding the qdisc lock. This results in a soft lockup and effectively a denial of service. The flaw is triggered via the quantum parameter exposed to tc commands and requires CAP_NET_ADMIN privileges. The impact is an interruption of packet scheduling that can stall kernel threads.

Linux kernel systems configured with CONFIG_NET_SCH_HHF=yes are affected. The flaw exists in any kernel version that lacks the recent fix, which clamped the quantum to a minimum of 256 and limited hhf_init to a range of [256, 1<<20]. There is no vendor‑specific version information provided; any distribution shipping a kernel with hhf enabled can be impacted.

The CVSS score is 5.5, indicating a medium severity vulnerability. The EPSS score is below 1%, suggesting a low probability of exploitation in the wild at this time. The issue is not catalogued in CISA KEV. It is locally exploitable by any process with CAP_NET_ADMIN in the target namespace, such as root or privileged users. Attackers could use the tc utility to specify a quantum of 1 on a system with the hhf qdisc enabled, causing the deficit‑refill loop to spin approximately 2^31 times while holding the qdisc lock and triggering a kernel soft lockup that disables packet scheduling and can reduce overall system responsiveness. Because the flaw requires the hhf qdisc to be present, disabling or patching the qdisc is the most effective mitigation.