The Linux kernel’s early boot routine contains a flaw where a string duplication function (kstrdup()) is called without verifying that the result of a memory allocation is not NULL. If a memory allocation fails while parsing the CPU model from the device tree, the kernel dereferences a NULL pointer, leading to an oops and system crash. The weakness is classified as CWE‑476: NULL pointer dereference, which results in a denial‑of‑service by crashing the kernel during boot.

Affected systems include all Linux kernel releases prior to the fix, namely versions up to 6.17 and the 7.0 release candidates rc1 through rc7. Any system running an unpatched kernel and an unmodified or potentially exploitable device tree is susceptible.

The vulnerability has a CVSS score of 5.5 and an EPSS score of less than 1 %. It is not listed in CISA’s KEV catalog. The likely attack vector requires local access or the ability to alter the device tree, inferred from the description that the fault occurs during early boot while parsing the device tree. Given the narrow exposure window and low exploitation probability, the overall risk is moderate, but a kernel crash remains a severe outcome.