The Linux kernel’s nexthop module contains a flaw where an uninitialized netlink_ext_ack structure is passed to notifier callbacks. The use of an uninitialized variable (CWE‑457) leads to a stale pointer when the notifier fails to set the message field, and the error path formats the stale pointer (CWE‑824). When the kernel is built with CONFIG_INIT_STACK_NONE, this results in a general protection fault that escalates to a kernel panic, crashing the system. The consequence is a denial of service; the flaw does not provide privilege escalation or data exfiltration.

All Linux kernel builds that include the nexthop code and are compiled with CONFIG_INIT_STACK_NONE are potentially affected. The patch applies to all kernel releases before the commit that zero‑initializes extack in nh_res_bucket_migrate(); any kernel using the vulnerable code path is at risk.

The EPSS score of < 1% indicates a very low probability of exploitation, and the CVE is not listed in CISA’s KEV catalog. An attacker can trigger the failure by sending crafted NETLINK messages through the host’s routing interface; remote exposure of that interface would be required for off‑host attacks. A single malformed message can cause a kernel panic, providing a straightforward denial‑of‑service vector. The CVSS score of 7.1 reflects the medium severity of this availability impact.