A logic flaw in the Linux kernel’s HFSC scheduler allows an infinite classification walk when an inner‑filter binding satisfies a level drift after bind time. The walk never exits the locked class tree, holding the queue‑discipline lock, disabling bottom‑half processing and eventually triggering a CPU watchdog timeout, a classic soft lockup that can lead to a kernel panic. The problem is not an information disclosure but a complete denial of service on the impacted system, affecting both the responsiveness of the affected kernel and the reliability of any services running on it.

All Linux kernel configurations that enable the HFSC qdisc (CONFIG_NET_SCHED and CONFIG_NET_SCH_HFSC) together with the u32 classifier (CONFIG_NET_CLS_U32) and the lockup detector (CONFIG_LOCKUP_DETECTOR). The bug can be triggered by any user that can apply a binding with CAP_NET_ADMIN through the unshare -Urn capability, meaning unprivileged users can develop the exploit. Vendors that ship kernels before the fix—regardless of version—are potentially vulnerable.

The CVSS severity for the described issue is high due to the unlimited loop and denial of service impact. Although the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the lack of a public exploit does not mitigate the risk: the bug can be exercised from user space with normal privileges and causes a system‑wide lockup without leaving a traceable network event. The attack vector is largely local, leveraging administrative configuration interfaces; an attacker simply applies the dangerous u32 filter configuration and sends a single packet (e.g., ping) to trigger the endless walk. Given the severity and the potential for a kernel panic, the vulnerability should be treated as a priority safety concern.