A local kernel pointer annotated with the cleanup attribute __cleanup(kfree) caused the kernel to free a stack address instead of the memory allocated by kmalloc, leading to an invalid deallocation. This flaw triggers a crash that typically manifests as a kernel panic, resulting in a denial of service. The vulnerability does not grant code execution or data exfiltration; it merely disrupts system availability.

All Linux kernel installations that employ the unpatched code path are impacted. The commit that introduced the __free(kfree) correction was merged into the mainline kernel; any kernel version derived from a release prior to that commit remains vulnerable. The specific affected kernel code is identified in the references and is present in all mainstream distributions that use the upstream kernel source before the patch was applied.

No public exploits have been reported and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 7.8, indicating high severity, while the EPSS score of <1% indicates a low probability of exploitation. Based on the description, it is inferred that the vulnerability requires local privileged execution, so only attackers with local or compromised administrative access can trigger the crash. The overall risk is moderate, primarily affecting availability rather than confidentiality or integrity.