In the Linux kernel, the memory allocator in mm/vmalloc triggers a BUG() when it mistakenly believes it is executing in an interrupt context, even though the context is only simulated by disabling bottom halves. This flaw is catalogued as CWE-617. The resulting BUG() causes an immediate kernel panic, halting system operation and providing a clear denial‑of‑service vector.

All Linux kernels running before the upstream commit that replaces the in_interrupt() check with in_nmi() || in_hardirq() are affected. The vulnerability surface is within the mm/vmalloc subsystem but is exercised along code paths used by the bridge and VLAN stack, notably when a bridge disables bottom halves while allocating memory for a VLAN entry.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploiting the bug requires an attacker to trigger the affected code path; however, the CVE description does not specify the required privileges, so it is inferred that privileged or local access may be necessary. If successful, the kernel panic results in system‑wide downtime.