A null pointer dereference occurs in the Linux kernel’s fuse‑uring implementation when a cancelled entry is moved to the ent_in_userspace list and later processed by ent_list_request_expired. The function dereferences the fuse_req field without checking for cancellation, which causes a kernel panic and a complete service outage. The flaw is a classic data‑sanitization bug that can lead to a denial of service but does not provide remote code execution or privilege escalation by itself.

All Linux kernel versions that include the fuse‑uring feature before the patch are vulnerable. The vulnerability is identified by the CPE for the Linux kernel, but no specific version range is supplied; therefore all affected kernel releases require the update once the patch is released.

The EPSS score is reported as < 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating a low likelihood of exploitation in the wild. The CVSS score of 5.5 indicates a moderate severity. The attack vector appears to be local, requiring the ability to submit and cancel fuse‑uring I/O operations, which a local user or compromised process could potentially do. Even though the probability of exploitation is low, the impact—kernel crash and loss of service—warrants prompt remediation.