A NULL pointer dereference occurs in the Linux kernel classifier filter (cls_fw) when an "old" style filter is added to a shared block before its change() function runs. This bug can trigger WARN_ON() and a BUG that results in a kernel crash. The crash does not compromise confidentiality or integrity—its primary impact is availability through a kernel halt. The code path requires privileged execution (CAP_NET_ADMIN) to inject the malicious filter, so the vulnerability is exploitable only by a user with elevated privileges. Once triggered, the system becomes unavailable until the kernel is restarted.

All Linux kernel releases that include the buggy cls_fw filter code before the fix commit (41845bc5). The patch removes the NULL dereference by skipping old‑style classification on shared blocks. The affected kernel is the standard Linux kernel; no specific vendor or product version list is supplied, so any kernel prior to the fix should be considered vulnerable.

The CVSS score is not supplied; however, a kernel crash is a high‑severity outcome. The EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires root or CAP_NET_ADMIN rights to add or modify traffic control filters, making it a local privilege‑oriented attack. Once the attacker can set up the trigger, the crash occurs immediately, yielding a denial of service. No remote exploitation path is indicated in the provided description.