The vulnerability arises because the Linux kernel allows policy namespaces to be nested without an upper bound, relying solely on the user namespace limit. An attacker can create arbitrarily deep policy namespace hierarchies, exhausting system resources and potentially causing service interruptions or system crashes. The flaw represents unbounded resource consumption and can undermine system availability without directly compromising data confidentiality or integrity.

The issue is present in the Linux kernel across all distributions that ship a kernel version containing unbounded policy namespace logic. The CVE notes the fix that hard‑caps policy namespace depth to match user namespace depth, but no specific kernel releases or version ranges are listed. Therefore any kernel build predating the patch is potentially vulnerable unless the vendor has applied the change.

EPSS is reported as below 1 % and the vulnerability is not in the CISA KEV catalog, indicating limited known exploitation. The likely attack vector is local or requires privileged kernel access, as creating and nesting policy namespaces requires kernel capabilities. Given the potential for resource exhaustion, the risk can be rated as moderate, but the probability of exploitation remains low under normal circumstances.