The vulnerability exists in the Linux kernel’s fuse‑uring subsystem. A failure in copying data to a userspace ring buffer leaves a request in the ent_w_req_queue with a NULL fuse_req pointer while the entry remains marked as FRRS_FUSE_REQ. Subsequent expiration logic can dereference this NULL pointer, resulting in a kernel crash. The core weakness is a NULL pointer dereference in kernel code, which can lead to a denial of service by crashing the system.

Affected systems are the Linux kernel. The exact kernel versions impacted are not listed in the CNA data; any kernel build that includes the fuse‑uring implementation may be vulnerable until patched.

The CVSS score of 5.5 classifies this vulnerability as medium severity; with an EPSS score of less than 1 % and no listing in CISA’s KEV, the likelihood of exploitation is low. The attack vector is inferred to be local or system‑level: an attacker must trigger a failing copy into the fuse‑uring ring buffer, an operation reserved for privileged processes. On successful exploitation, the resulting NULL pointer dereference would crash the kernel, delivering a denial‑of‑service outcome to the affected system.