The flaw lies in the Linux kernel’s handling of hugepage parameters on the boot line. When hugetlb, hugepagesz, or default_hugepagesz are supplied without an '=' separator, the command‑line parser passes a NULL pointer to the parsing routine, which then dereferences it in a string length call, causing an early crash. This vulnerability permits a denial‑of‑service condition manifested as a system halt at boot time. This is a null pointer dereference issue, classified as CWE‑476, a critical kernel reliability problem.

The defect affects Linux kernel builds in general. No specific vendor or product version numbers were provided in the data, so any kernel compiled from the official Linux source tree before the fix may be impacted. Reducing risk requires confirming the kernel version and whether the patch has been applied.

The exploit likelihood is not quantified in EPSS, and the vulnerability is not listed in the CISA KEV catalog, implying limited public exploitation evidence at this time. Nevertheless, because the flaw triggers during the boot sequence, an attacker who can influence the boot parameters—either locally or via a compromised bootloader configuration—can force the system to crash. In environments where unattended or scheduled boot jobs are critical, the risk translates to potential downtime and service disruption. The CVSS score is 5.5. The impact is a denial of service on the target machine, but the severity is moderate. Potential mitigations include applied kernel patches and ensuring correct parameter syntax in bootloader configurations.