The vulnerability involves an allocation of memcard structures in the Linux kernel’s MTD VMU Flash subsystem. By using kmalloc_obj()/kmalloc_objs() instead of kzalloc_obj()/kzalloc_objs(), the code could read uninitialized data, leading to a fault in an unaligned fixup at mtd_get_fact_prot_info. The fault manifests as a kernel panic, effectively denying service by crashing the system. The weakness is a classic case of uninitialized memory access. This corresponds to the weakness identified as CWE-824.

appears in the Linux kernel, affecting all builds that include the mtd/maps/vmu-flash path before the patch referenced by the commit logs. No specific kernel version range is given, but any kernel version that contains this code path and has not applied the suggested fix is vulnerable.

The EPSS score is reported as < 1%, indicating a very low but nonzero exploitation probability, and the CVE is not listed in KEV, implying no known public exploitation yet. The CVSS score of 5.5 indicates a moderate severity. The flaw appears to require local execution of code that interacts with the mtd/maps/vmu-flash subsystem; the attack vector is inferred to involve a privileged process or malicious driver, but this inference is not explicitly documented in the advisory. An attacker could, hypothetically, trigger the fault in the unaligned VMU flash subsystem, leading to a kernel crash and a denial of service.