The kernel contains a flaw in the handling of kmalloc_nolock() when the PREEMPT_RT configuration is enabled and preemption is disabled. In these conditions, the function attempts to acquire a sleeping lock in an atomic context, triggering a BUG that brings the kernel to an Oops and halts the system. This failure can be reproduced by executing BPF programs from tracepoints while preemption is disabled, thereby causing a kernel crash and a system denial of service. The weakness is a failure to validate the execution context before acquiring a resource, a classic example of improper function use.

Affected systems include Linux kernel releases 6.19 and its release candidates (rc1–rc6) and any PREEMPT_RT-enabled kernel version before the patch is applied. The vulnerability is present in the generic Linux kernel and any derivative that incorporates the same kmalloc_nolock implementation without the fix.

The CVSS score of 5.5 indicates medium severity, and the EPSS score of <1% implies a very low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Attack likely requires local privileges or the ability to run BPF programs or trigger tracepoints, making it a local or privileged remote attack vector. While the impact is severe – a kernel crash – the narrow execution conditions and low exploitation likelihood reduce overall risk for most systems.