The flaw is a null pointer dereference in the IPVS subsystem of the Linux kernel. When an IPVS service is added, the scheduler pointer is correctly bound but can be reset to NULL if a subsequent estimator fails. The cleanup routine then dereferences this NULL scheduler pointer, causing a kernel panic. This denial‑of‑service condition brings the kernel into an irrecoverable state.

Linux kernel builds that include the IPVS (IP Virtual Server) module and have not yet applied the relevant patch are vulnerable. The regression becomes observable in recent releases such as 6.2 when the new error path is exercised after a failure in ip_vs_start_estimator. Any system running a vulnerable kernel with IPVS enabled and accessible to privileged callers can be affected.

The CVSS score of 5.5 classifies the vulnerability as medium severity. The EPSS score is < 1 %, indicating a very low probability of exploitation according to the EPSS model. The vulnerability is not yet listed in the CISA KEV catalog, so no publicly known exploits exist. The likely attack vector requires an attacker with application‑level or privileged access to invoke nf_setsockopt and add or modify an IPVS service. If the error path is triggered, the system will crash, resulting in a denial of service that impacts availability but does not directly compromise confidentiality or integrity.