In the Linux kernel, the SLRAM MTD device registration routine links a new list entry before allocating all required state. If a subsequent memory allocation, remapping, or device registration fails, the partially constructed entry remains on the global list. When the system later cleans up, the dangling entry causes dereferences or frees of invalid memory, leading to kernel memory corruption. This can result in a kernel panic, loss of service, or if an attacker controls the allocation path, potential privilege escalation. The likely attack vector involves local exploitation through loading or manipulating MTD devices, though remote exploitation would require code execution privileges to trigger the failure paths.

All Linux kernels that include the SLRAM MTD subsystem are affected. No specific upstream version numbers are provided; the vulnerability exists in any kernel build that has not applied the mitigation commit referenced in the advisory.

The CVSS score is not provided, and EPSS information is unavailable, but the vulnerability involves critical kernel memory handling. It is listed as not in the CISA KEV catalog. Because the flaw requires control over device registration or failure handling, it is considered a local exploit with high potential impact. No public exploits are reported, but the risk of exploitation remains significant for affected systems.