The flaw is found in the Linux kernel’s traffic‑control module, specifically the cls_flow subsystem. When a flow filter is created on a shared block whose queue pointer is null, the flow_change function dereferences the null queue handle, causing a kernel panic. This is a pure crash condition and does not permit arbitrary code execution; it results in a denial of service by making the host unusable or requiring a reboot.

Any Linux system that includes the vulnerable cls_flow implementation and has not yet integrated the upstream null‑check is affected. This applies to all distributions shipping the unpatched kernel source where the commit adding the safety guard has not been incorporated. The vulnerable code exists in the core kernel, so the impact is not limited to a specific distribution. No explicit version range is listed, but any kernel version before the patch is considered vulnerable.

The CVSS score of 5.5 rates the severity as moderate. The EPSS score of < 1 % indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The description implies that the attack would require sending a crafted netlink message to create a problematic flow filter, which typically needs CAP_NET_ADMIN or root privileges. Consequently, the overall risk is moderate for hosts where an adversary can influence networking configuration, while it remains lower for strictly isolated or privileged‑restricted environments.