The vulnerability in the Linux kernel's net/sched code involves improper handling of ets qdisc class changes. When a user changes a drr class to a strict class, the code fails to check and remove the class from the active list if it was present, allowing the class to be added twice if toggled back. This results in a double-add to the kernel's linked list, triggering kernel warnings and potential crashes. The issue is triggered by a sequence of tc qdisc add and change commands followed by ping commands, causing a kernel splat with list debug messages. The fix involves adding a check to remove the class from the active list when changing it to strict, preventing double additions.

The vulnerability can cause kernel crashes (kernel panics) due to double addition of a class in the active list, leading to system instability or denial of service. It requires local privileges to trigger via tc commands and affects the integrity and availability of the system. Confidentiality impact is rated high in the CVSS vector, but the primary impact is denial of service due to kernel crashes.

A fix has been implemented in the Linux kernel to address this issue by ensuring the ets class is removed from the active list when changed to strict. Users should update their Linux kernel to a version that includes this fix. Patch status is not explicitly provided in the input; therefore, check the vendor or kernel mainline advisories for the official fixed version and apply updates accordingly.