The Linux kernel’s nexthop module includes a flaw where an uninitialized netlink_ext_ack structure is passed to notifier callbacks. This reflects CWE‑824, improper initialization, because the structure is not zero‑initialized before use. If a notifier fails to populate the message field, the error path formats the stale pointer, which triggers a general protection fault. When the kernel is compiled with CONFIG_INIT_STACK_NONE, that fault escalates to a kernel panic, crashing the system. The result is a denial of service; no elevated privileges are required to trigger it.

Every Linux kernel build that contains the nexthop code and is compiled with CONFIG_INIT_STACK_NONE is potentially affected. Because the CVE does not enumerate specific releases, any kernel version that retains the vulnerable code path before the patch in the cited commit may be at risk.

The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, but it can be activated by an attacker who can send crafted NETLINK messages to the host. The likely attack vector is local or any process with NETLINK capabilities; remote exploitation would require a publicly exposed NETLINK interface. If the attacker can invoke the buggy notifier path, a single message will cause a kernel panic and loss of availability. The CVSS score of 7.1 reflects a medium severity impact, which still represents a non‑trivial risk to availability for affected systems.