The vulnerability occurs when the kernel’s dentry cache hash table is forced to use only one bucket by setting the sysctl parameter dhash_entries to 1. The hash shift value computed by dcache_init then becomes larger than the bit width of a 32‑bit integer, causing the lookup procedure to calculate an array index that points outside the allocated bucket array. This out‑of‑bounds read occurs during a hash bucket scan and triggers a supervisor page fault, resulting in a kernel OOPS. The crash can destabilize the system and may be exploitable if an attacker can influence the parameter or trigger the lookup path, but no clear exploit path is described in the provided information.

All Linux kernel versions that allow sysctl dhash_entries to be set to 1 are affected. No specific kernel releases are listed, so any distribution using a kernel before the patch that limits the minimal number of hash buckets to two remains vulnerable.

The CVSS score is not provided, and the EPSS score is not available. The vulnerability is listed in CISA KEV as not present. Because the exploit requires kernel parameter manipulation and a non‑trivial path to trigger the out‑of‑bounds read, the current risk is uncertain, but a crash is guaranteed if the conditions are met.