In the Linux kernel, a null pointer dereference can occur in the BPF subsystem. The check for memory access matches a pointer type that incorrectly allows direct dereference when the pointer can be NULL. When BPF programs reach an end‑of‑context callback, the map iterator pointers may be NULL, causing a kernel NULL dereference and a system crash. This vulnerability is a classic null pointer dereference (CWE‑476) and results in a denial of service for processes that rely on the kernel’s stability.

Affected releases are Linux kernel versions before the patch that added a guard against null pointers when dereferencing PTR_TO_BUF pointers. The exact affected version range is not specified, but any kernel sequence lacking that fix is vulnerable.

The CVSS and EPSS scores are not available; the vulnerability is not listed in the CISA KEV catalog. The risk is significant because the flaw occurs in privileged kernel code, and a successful exploit would crash the system. Exploitation would require the ability to load or execute BPF programs that reach the faulty cleanup path, which may be achievable by a local privileged user or potentially remotely if another weakness permits BPF program injection.