The vulnerability stems from the Linux kernel’s copy_process() function, where the PF_BLOCK_TS flag is inherited by a child process while its plug pointer is cleared to NULL. PF_BLOCK_TS is meant to indicate that a process has a valid plug, and callers rely on this invariant to safely dereference current->plug. When the flag is incorrectly left set, a subsequent unguarded dereference can cause a null‑pointer dereference, resulting in a kernel OOPS or crash. This represents a CWE‑476 flaw, and the impact is a kernel crash that can bring the host down and act as a denial‑of‑service.

The flaw exists in all Linux kernel builds that have not incorporated the commit that clears PF_BLOCK_TS in copy_process(). Any distribution kernel containing the older behavior—i.e., kernel releases before the patch—remains vulnerable. Systems running these kernels are susceptible to the crash condition described above.

The CVSS score of 5.5 places the vulnerability in the moderate severity band. The EPSS score of < 1 % indicates a very low likelihood of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. Exploitation requires an attacker to trigger the PF_BLOCK_TS invariant violation, typically requiring privileged kernel access or the ability to spawn processes that exercise the bug. As a result, the principal risk is availability loss rather than compromise of confidentiality or integrity.