A logic flaw in the Linux kernel’s HFSC scheduler allows an infinite classification walk when an inner-filter binding satisfies a level drift after bind time. The walk never exits the locked class tree, holding the queue-discipline lock, disabling bottom-half processing and eventually triggering a CPU watchdog timeout, a classic soft lockup that can lead to a kernel panic. The problem is not an information disclosure but a complete denial of service on the impacted system, affecting both the responsiveness of the affected kernel and the reliability of any services running on it.

All Linux kernel configurations that enable the HFSC qdisc (CONFIG_NET_SCHED and CONFIG_NET_SCH_HFSC) together with the u32 classifier (CONFIG_NET_CLS_U32) and the lockup detector (CONFIG_LOCKUP_DETECTOR). The bug can be triggered by any user that can apply a binding with CAP_NET_ADMIN through the unshare -Urn capability, meaning unprivileged users can develop the exploit. Vendors that ship kernels before the fix—regardless of version—are potentially vulnerable.

The CVSS score for this vulnerability is 5.5, indicating a medium‑severity denial‑of‑service impact. The EPSS score is <1%, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the flaw can be triggered from user space without elevated privileges by applying a u32 filter with a dropped flowid binding that drifts in level; a single packet such as ping will cause the infinite classification walk, a soft lockup that can ultimately lead to a kernel panic. The attack vector is local, relying on the ability to configure the HFSC qdisc and u32 classifier, which can be performed by any user with CAP_NET_ADMIN privileges through the unshare-Urn mechanism.