A NULL pointer dereference occurs in the Linux kernel’s shrinker debugfs implementation. The code creates "count" and "scan" debugfs files without verifying that the shrinker’s count_objects() or scan_objects() callbacks are present. When a shrinker has one of these callbacks missing—such as the xen-backend shrinker that sets count_objects() but leaves scan_objects() NULL—writing to the missing file causes the kernel to call through a NULL function pointer and crash. The resulting kernel panic represents a serious denial‑of‑service condition, as the affected system will reboot or halt until the fault is addressed. The weakness originates from improper validation of function pointers.

All Linux kernel builds containing the unpatched mm: shrinker debugfs logic are potentially affected. The announcement does not specify a particular kernel version range, so any kernel with this code before the patch is at risk. This statement is inferred because the vulnerability description does not list a specific range. It also assumes that debugfs is enabled for the system, which is not stated explicitly but is necessary for the fault to be triggered.

The EPSS score is less than 1 %, indicating a very low probability that this flaw has been actively exploited. The vulnerability is not listed in the CISA KEV catalog, so high‑impact exploitation is unlikely. The likely attack vector is inferred to be local with elevated privileges: an attacker would need to write to the offending debugfs file, which typically requires root or the ability to mount debugfs as a privileged user. This inference is drawn from the fact that writing to the file triggers the kernel panic, so debugfs must be writable by the attacker. The impact of a kernel panic—system downtime and potential data loss—makes the risk moderate for environments where debugfs is writable by privileged users.