This vulnerability arises in the Linux kernel's networking stack, where a callee function incorrectly writes to the msg_get_inq member of an msghdr‑like structure. If the caller has not reinitialized that field or if the message structures are reused, a NULL pointer dereference can occur. The bug was introduced by recent commits that changed the handling of UNIX domain socket requests for input queue length. The result is a kernel crash, potentially causing a denial of service for the affected host. Because the flaw is inside kernel code, exploitation could elevate a local process to kernel privilege implicitly, but the primary impact is a denial of service.

The flaw affects the Linux kernel across all supported releases, including 6.19 rc4 and any kernel that incorporates the relevant commits from commit 4d1442979e4a, 2b514574f7e8, and the following fix commit. The affected code resides in the AF_UNIX socket implementation, specifically in unix_stream_read_generic and related splice paths.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is less than 1 %, implying a very low probability of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog, and there are no publicly documented exploits. The attack would require a local user to interact with the vulnerable socket operations, making it a local denial‑of‑service vector. Because the kernel crash is non‑remote, a patch is the most effective countermeasure.