The Linux kernel contains a flaw in the SMC networking code where a malicious peer can send a CONNECT request with a CHID value of 0. The kernel code incorrectly matches this CHID against an uninitialized entry in the isl_dev array, resulting in a null pointer dereference when the code later attempts to lock the non‑existent device structure. This causes a kernel crash (KASAN bug) and can be exploited to take the system offline. The weakness is classed as a NULL pointer dereference (CWE-476).

All Linux kernel distributions that compile the net/smc subsystem are affected, as the issue resides in the kernel source and is not limited to a specific vendor. No specific version range is listed, so any kernel built from the unpatched source could be vulnerable.

The CVSS score of 7.5 indicates a high severity, but the EPSS probability is below 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting a low current exploitation likelihood. Based on the description, it is inferred that the likely attack vector is a network connection to the vulnerable SMC-Dv2 interface, allowing the attacker to send a crafted CONNECT request. Once activated, the flaw results in a denial of service rather than privilege escalation or data leakage.