The flaw arises when arch_set_shadow_stack_status() checks for a NULL return from alloc_gcs() while alloc_gcs() may return an error‑encoded pointer that is non‑NULL. The incorrect check allows the kernel to use an invalid GCS address, leading to memory corruption or a crash. This improper error handling can potentially be exploited by a malicious local user to gain elevated privileges or destabilize the system. (The attack vector is inferred to require local kernel access to trigger the error path.)

Linux kernel on ARM64 architecture. All builds prior to the fix commit that added proper IS_ERR_VALUE() checking are affected. No precise version numbers are listed.

No CVSS or EPSS score is available, and the vulnerability is not listed in CISA KEV catalog. Exploitability depends on the attacker's ability to cause alloc_gcs() to fail, so the most likely scenario is local kernel exploitation that can lead to denial of service or privilege escalation. Given the lack of public exploit information, the risk is moderate but should be treated with due seriousness.