The Linux kernel net_sched subsystem had a memory leak vulnerability in deferred qdisc drops. The network stack's cleanup of deferred lists via qdisc_run_end() operated on the root qdisc. If the root qdisc lacked the TCQ_F_DEQUEUE_DROPS flag, packets queued for freeing were never released and remained stranded on the child's local to_free list. The fix involves making qdisc_dequeue_drop() aware of the root qdisc's flags, appending packets directly to the root's to_free list if the flag is present, or dropping them directly otherwise, restoring correct memory management.

This vulnerability causes a memory leak in the Linux kernel's network stack, potentially leading to increased memory consumption and degraded system performance over time. There is no indication of direct privilege escalation, code execution, or denial of service beyond resource exhaustion from the leak. No known exploits are reported in the wild.

A fix is available for this vulnerability in Linux kernel versions 7.0.0-28.28.1 and later. Users should update to a patched kernel version to resolve the memory leak issue. Since this is a kernel-level fix, applying the official kernel update from the vendor or distribution is the recommended remediation.