The vulnerability in the Linux kernel's net/sched subsystem affected the DualPI2 scheduler's handling of GSO skb segmentation. When DualPI2 splits a GSO skb into multiple segments, it incorrectly propagates the number of segments to its parent queue, causing the parent's queue length to be larger than the actual number of packets queued. With QFQ as the parent scheduler, this mismatch leads to a situation where the queue length is non-zero but no active classes exist, causing qfq_choose_next_agg() to return NULL and subsequently triggering a NULL pointer dereference in qfq_dequeue(). The fix aligns DualPI2's accounting with patterns used by other schedulers, counting only successfully queued segments and returning NET_XMIT_SUCCESS if at least one segment was queued.

The vulnerability can cause a NULL pointer dereference in the Linux kernel's network scheduler, potentially leading to a kernel crash (denial of service) when QFQ is used as the parent scheduler of DualPI2. There is no indication of code execution or privilege escalation. No known exploits in the wild have been reported.

A fix for this vulnerability has been implemented in the Linux kernel by correcting the GSO backlog accounting in the DualPI2 scheduler. Users should apply the official kernel updates that include this fix. Since no vendor advisory or patch links are provided, check the Linux kernel mailing lists or official kernel repositories for the relevant patch and update guidance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.