A null pointer dereference occurs in the Linux kernel RDS implementation when IPv6 is disabled via the boot parameter ipv6.disable=1. The inet6_addr_lst data structure is never initialized, causing a crash during an attempt to bind an RDS socket to an IPv6 address. The resulting kernel panic leads to a system reboot or halt, preventing legitimate services from operating and allowing an attacker to cause a denial of service by inducing the crash. This weakness is a classic null pointer dereference identified by CWE-476, affecting the confidentiality, integrity, and availability of the host. The vulnerability is limited to systems that enable IPv6 disabling and use the RDS protocol, so the scope is a single host but can be triggered by any process attempting to bind to IPv6 addresses with RDS sockets. The crash is deterministic and occurs without requiring elevated privileges, meaning any local user can exploit it. Based on the official kernel patches, the vulnerability is fully mitigated by the provided fix.

The affected systems are all Linux kernel implementations where IPv6 can be disabled at boot via the ipv6.disable=1 parameter and where the RDS protocol is enabled. The fix applies to all kernel releases after the patch commit referenced in the advisory, and it addresses the issue in the kernel's ipv6_init and inet6_addr_lst initialization logic. Specific affected kernel versions are not enumerated in the advisory, so any kernel prior to the patch that allows disabling IPv6 remains vulnerable.

The CVSS score is not disclosed in the advisory, and the EPSS is not available, so the precise exploitation probability cannot be quantified. However, the vulnerability can be trivially triggered by any local user on a system that has disabled IPv6 and uses RDS sockets, meaning the likelihood of exploitation is high in environments that meet those conditions. The advisory does not list the vulnerability in the CISA KEV catalog, suggesting that known, publicly released exploits are not yet documented. Therefore, the risk is primarily a DoS potential that could impact service availability on vulnerable hosts. The likely attack vector is local, via an unprivileged or privileged process that can bind to an RDS socket, and the impact is complete loss of service on the affected machine.