In the Linux kernel, a child cpuset that does not have cpuset.mems configured can trigger a division‑by‑zero error during a CPU hotplug event. When the kernel attempts to rebind a VMA memory policy that uses MPOL_F_RELATIVE_NODES, it passes an empty node mask to the rebind routine, causing a crash. The resulting kernel panic destroys system availability; all running processes are terminated and the host becomes unusable until a reboot or kernel restart. The weakness is an integer division by zero, corresponding to CWE‑190.

The flaw resides in the Linux kernel’s cgroup cpuset implementation and affects all affected kernel releases before the patch. Anyone running an unpatched Linux kernel that creates a cpuset without setting cpuset.mems and subsequently performs a CPU hotplug operation is susceptible.

The exploit requires the attacker to create a cpuset and move a task into it, which typically requires root or kernel privileges. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, implying that public exploitation is not yet confirmed. However, because the flaw causes a kernel crash, the risk of denial of service is high. If an attacker can supply the conditions (cpuset creation and CPU hotplug) they can arbitrarily halt a system. The likely attack vector is local with elevated privileges; remote exploitation would require further steps to gain such privileges.