A null pointer dereference is triggered in the block subsystem’s bio_integrity_map_user routine when the underlying page‑pinning function, pin_user_pages_fast, returns a count of successfully pinned pages that is less than requested. Because the routine does not detect this partial pinning, it later calls bvec_from_pages with an address that was not pinned, which resolves to zero and is dereferenced. This dereference causes a general protection fault that results in a kernel oops and a system crash, providing an attacker with a denial‑of‑service vector.

Any Linux kernel that has not incorporated the patch committed in 76410790f1491c8e06a451045ae223a61c652455 is affected. The issue was observed in kernel 7.0.0‑11783 and applies to all earlier or equivalent releases that have not applied the fix. Distribution‑specific kernel packages that contain the same vulnerability will behave similarly, regardless of the vendor.

The CVSS base score of 5.5 indicates moderate severity, and the EPSS score of <1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV. Attack is most likely local or privileged, requiring the ability to initiate block operations such as nvme‑passthrough that exercise the vulnerable routine. An attacker with sufficient local privilege can induce a kernel crash and disrupt availability of the affected host.