In the Linux kernel, the decompress module fails to verify the return value of a memory allocation routine, causing a NULL pointer dereference. When the allocation fails, subsequent page requests treat the resulting address as valid, triggering a kernel oops and system crash. Based on the description, it is inferred that an attacker must have sufficient privileges to load kernel modules to exploit this flaw, which results in a denial of service that disrupts all processes on the host.

The issue affects all Linux kernel releases in which the decompress module is present, as the vendor product list specifies Linux:Linux without version constraints. No specific version restrictions are documented, so any kernel running the affected code path is a potential target.

The EPSS score is reported as less than 1%, indicating a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local or elevated privileges to load or influence kernel modules, so the likely attack vector is local. Because the flaw results in a system crash rather than privilege escalation, the overall impact is confined to service interruption but can be severe in production environments.