A NULL pointer dereference occurs in the handling of IPv4 and IPv6 socket mediation within the Ubuntu Linux kernel. When an unprivileged local user triggers this flaw, the kernel panics and triggers an oops, leading to an immediate system crash. The primary consequence is loss of availability for the affected host, as the kernel oops undoes all running processes and requires a reboot to resume normal operation.

Canonical Ubuntu Linux kernels 6.8, 6.17, and 7.0 are affected. Users running these kernel versions are susceptible to the vulnerability if they have local user accounts that can submit arbitrary network socket operations.

The CVSS score is 3.3, indicating a low severity potential impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, which limits its current exploitation visibility. The attack vector is local and requires an unprivileged user to manipulate socket mediation, making it accessible on machines with inbound user access. Although the flaw does not provide immediate escalation or data exfiltration, the resulting kernel panic can be leveraged as a denial‑of‑service attack against the host.