A null-pointer dereference is triggered in the kernel's UDP Lite path when the socket initialization routine fails, leaving udp_sk->udp_prod_queue unset. The subsequent call to __udp_enqueue_schedule_skb then dereferences the null pointer, causing KASAN to report a fault and the kernel to panic. This results in an OS crash that requires a reboot, providing an attacker with a local denial‑of‑service vector.

Any Linux kernel that includes the udplite subsystem and has not yet applied the patch that changes udplite_sk_init() and udplitev6_sk_init() is vulnerable. The issue is present in both IPv4 and IPv6 implementations and therefore applies to all distributions, cloud images, and embedded devices shipping the unpatched upstream kernel source. The CNA data lists no specific version range, so the vulnerability is effectively all kernels prior to the commit that introduced the fix.

While the CVSS score is not given, the attack path is straightforward: an adversary can send specially crafted UDP Lite traffic that forces the enqueue routine to execute when the socket is in a failure state. The lack of an EPSS value and the absence from the CISA KEV catalog indicate that public exploitation is not confirmed, but a kernel panic would cause a service outage. Consequently, the potential impact is high, and the exploitation likelihood is reasonable in environments where UDP Lite traffic can reach the target.