The Linux kernel’s debugfs_create_str() routine expects a valid pointer or NULL for the string it creates. In this vulnerability the src_node and dst_node strings were left uninitialized before the debugfs entries were created, causing the routine to operate on undefined memory. This can lead to an invalid memory access in the kernel, resulting in a crash or data corruption. The impact is limited to systems running the affected kernel with debugfs enabled and would typically require local system access. The weakness is listed as CWE‑908, a buffer or string misuse issue.

Linux kernel 6.19 release candidates rc1 through rc6 are affected. All distributions shipping these kernels are at risk unless the patch has been applied.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is below 1%, implying low exploitation likelihood. It is not listed in CISA’s KEV catalog. The likely attack vector is local; an attacker would need to trigger the creation of the vulnerable debugfs entries, which requires kernel context. Exploitation would most likely result in a kernel crash or data corruption rather than arbitrary code execution.