During early kernel initialization a division by zero can occur if the console=uart8250 baud rate is empty, zero, invalid, or overflows to zero. The bug causes the system to hang before the operating system starts, resulting in a denial of service that affects system availability. The flaw is a classic divide‑by‑zero error (CWE‑369).

All x86 builds of the Linux kernel that lack the patch for early_serial_init(). The issue applies to any kernel release before the commit that validates and defaults the baud rate. It is relevant for production servers, embedded devices, and PCs where serial console access is enabled.

The CVSS score of 5.5 indicates a medium severity, and the EPSS score of <1% suggests a very low likelihood of exploitation. The denial of service nature can still impact system availability. The vulnerability is most relevant to attackers who can influence the kernel boot parameters, such as those with physical access or compromised bootloader configuration. Because the flaw requires boot‑time manipulation and no remote exploitation path is described, the risk to remote attackers remains low. The vulnerability is not listed in CISA’s KEV catalog.