The flaw is a null pointer dereference that occurs in the Linux kernel’s cgroup/dmem subsystem when an administrator writes to the dmem.max file without specifying a resource limit. The kernel then crashes into an Oops state, causing a kernel panic that renders the host system unavailable. This vulnerability does not grant code execution or privilege escalation on its own; its primary consequence is an availability loss for the affected machine.

All Linux kernel builds that implement the cgroup/dmem interface and lack the recent patch are vulnerable. The issue was observed in a 6.19.0-rc6-next build and is addressed in newer releases of the kernel. Distributions shipping kernel versions preceding the fix remain at risk regardless of other configuration settings.

With a CVSS score of 5.5 the engineering severity is moderate. An EPSS score of less than 1% indicates that the likelihood of real-world exploitation is currently extremely low, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred from the description: local access with the ability to write to /sys/fs/cgroup/dmem/dmem.max, typically requiring root or privileged access. When written to without a limit, the kernel panics, but no further compromise is possible beyond the denial of service.