The Linux kernel scheduler component net/sched includes an FQ PIE qdisc. The function fq_pie_change accepts any quantum value from userspace, even the minimum value of one. When a quantum of one is used in conjunction with a size table that results in a qdisc packet length near two gigabytes, the deficit‑refill loop performs roughly two to the thirty‑first iterations while holding the qdisc lock. The loop thus spins for an extended period, causing a soft lockup that effectively denies service to all processes on the affected system.

The flaw affects Linux kernel builds where the FQ PIE qdisc is enabled (CONFIG_NET_SCH_FQ_PIE=y). Any kernel version that exposes this qdisc is vulnerable until the patch that clamps the quantum to a minimum value is applied. Systems with a user that holds CAP_NET_ADMIN privileges, such as local administrators or compromised accounts, can trigger the issue by using the tc command to set the quantum to one with an oversized size table.

EPSS data indicate a very low probability of exploitation, with a score of < 1%. The immediate risk is limited to hosts where an attacker can gain CAP_NET_ADMIN privileges, typically local privileged users or compromised accounts. The denial‑of‑service effect is complete for the host, putting the kernel into a soft lockup that requires a reboot or removal of the qdisc to recover. Because the vulnerability is not listed in the CISA KEV catalog, there are no publicly reported exploitation campaigns, but the potential impact warrants timely patching. The CVSS score is 5.5, indicating moderate severity.