Within the batman‑adv networking stack of the Linux kernel, the function that purges unused claims walks a hash list while holding an rcu_read_lock. During this traversal, a concurrent release of a claim can free its memory while it is still being examined; the code then attempts to dereference a backpointer that has been set to NULL. This fault causes a NULL‑pointer dereference in kernel space, leading to a kernel panic and system-wide denial of service. The weakness is a classic dereference of a null pointer (CWE‑476).

All Linux kernel installations that include the batman‑adv module are affected, independent of distribution. The fix is incorporated in the mainline kernel through the series of commits referenced in the advisory; any kernel build that includes these patches will no longer process unreferenced claims incorrectly.

Based on the description, it is inferred that an attacker would need local or privileged access to the target system to trigger the crash by interacting with the batman‑adv module. No public exploit is known and the EPSS score is below 1%; the vulnerability is not listed in the CISA KEV catalog, suggesting that active exploitation has not been observed. The reported CVSS score of 5.5 indicates a medium severity rating, but the kernel-level NULL dereference still signals a reasonably serious risk.