In the Linux kernel, a null pointer dereference can occur in the BPF subsystem. The check for memory access matches a pointer type that incorrectly allows direct dereference, omitting a null check. When BPF programs reach an end‑of‑context callback, the map iterator pointers may be NULL, causing a kernel NULL dereference. This vulnerability is a classic null pointer dereference (CWE‑476) and results in a denial of service by crashing the kernel.

Affected releases are Linux kernel versions before the patch that added a guard against null pointers when dereferencing PTR_TO_BUF pointers. The exact affected version range is not specified, but any kernel sequence lacking that fix is vulnerable.

The CVSS score is 5.5, and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog. The risk is significant because the flaw occurs in privileged kernel code, and a successful exploit would crash the system. Based on the description, it is inferred that exploitation requires the ability to load a BPF program that triggers the faulty cleanup path, which is typically available to users with BPF execution privileges.