The vulnerability originates in the Linux kernel's dm‑verity subsystem, where errors from dm_bufio_client_create() are not correctly handled. If either creation call fails, a subsequent call to dm_bufio_client_destroy() receives an ERR_PTR argument, triggering a crash. This fault leads to a denial of service by bringing the kernel down and disrupting system availability.

All Linux kernel deployments that use the dm‑verity subsystem before the inclusion of the identified patch commit series. The fix applies to all supported kernel versions that incorporate the dm‑verity code path, as referenced by the provided git commit URLs.

The CVSS score is not provided, and EPSS data is unavailable, making it difficult to quantify the likelihood of exploitation. Nonetheless, the defect can be triggered by interacting with the dm‑verity monitoring mechanism, implying a local or privileged execution requirement. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation at the time of reporting.