A null pointer dereference occurs in the cls_fw traffic-control filter when an empty cls_fw filter is attached to a shared block and a packet with a non-zero major skb mark is classified. The vulnerability can cause a kernel panic, leading to a service interruption. The weakness is a NULL pointer dereference, CWE-476.

Vendors affected are Linux distributions that ship the Linux kernel. The issue exists in any kernel that has exposed the cls_fw filter and shared block functionality without the patch. No specific version numbers are listed, so any kernel prior to the fix commit is potentially vulnerable.

The CVSS score is 5.5, indicating a moderate severity. The exploit is local and requires permission to configure traffic-control filters, so it is unlikely to be remotely exploitable without elevated privileges. No EPSS value is available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited current exploitation activity. The typical attack path would be an attacker who can deploy traffic-control filters on the machine; they would attach an empty cls_fw filter to a shared block and send a traffic packet with a non–zero mark to trigger the crash.