A missing check for error pointers in the Linux kernel's rxrpc subsystem can cause the afs module to treat an error state as a valid object. The function rxrpc_kernel_lookup_peer() may return error pointers instead of NULL, but callers only verify for NULL. When an error pointer is interpreted as a valid address and dereferenced, this can trigger a kernel crash, leading to a denial of service for the local system.

All Linux kernel releases that include the rxrpc and afs components and that were built before the commit that fixes the error‑pointer handling are affected. This includes any distribution's kernel that has not yet been updated to incorporate the patch referenced in the advisory.

The EPSS score of <1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires the kernel to process an rxrpc or afs request, the likely attack vector is local or involves trusted network traffic with sufficient privileges. The CVSS score of 7.0 reflects a Medium severity impact, primarily the loss of availability through a kernel crash.