In the Linux kernel, a null‑pointer dereference is introduced in the rxrpc subsystem. When the kernel processes a to‑client packet after the associated client call on a channel has been torn down, the code incorrectly attempts to drop a call reference that was never acquired. This unconditionally invokes a reference release on a NULL pointer, which triggers a kernel panic. The fault results in an immediate loss of availability for the affected system.

The vulnerability affects all Linux kernel builds that include the vulnerable rxrpc code. The supplied CPE list covers the generic kernel and specific releases 6.2 and 7.0 release candidates (rc1 through rc7). Any system running an affected version of the Linux kernel is at risk.

The CVSS score of 7.5 indicates a high severity denial‑of‑service risk. The EPSS score of less than 1 % suggests that exploitation is currently rare, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Because rxrpc is a kernel‑level RPC protocol, the likely attack vector is a network attacker sending a crafted packet to the kernel. An attacker would need to connect over the rxrpc socket or otherwise inject a bad packet directed at the vulnerable channel. The impact is a kernel crash that brings down the host, though no elevation of privilege or data theft is described.