The vulnerability originates in the dm‑era component of the Linux kernel where the function metadata_open() returns NULL if memory allocation fails. The caller era_ctr() checks only IS_ERR(md), which incorrectly treats a NULL pointer as valid because IS_ERR(NULL) is false. This misinterpretation allows the NULL pointer to be stored in era->md, and when the metadata is later accessed, the kernel dereferences a NULL pointer, triggering a kernel panic. The resulting crash isolates the system from service, effectively denying availability for any process interacting with dm‑era's metadata functionality.

Affected systems are Linux kernel installations that include the dm‑era module before the fix was merged. All kernels that compile dm‑era without the patch are vulnerable; no specific version identifiers are provided in the advisory, so any kernel version lacking the commit should be considered affected.

The EPSS score indicates a low exploitation probability, with a value of 0.22%, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 7.0 indicates a medium severity vulnerability. Exploitation requires delivery of a request that triggers metadata_open() when kzalloc_obj() fails, which typically requires a local attacker with the ability to influence device mapper metadata operations. The attack vector is therefore likely local; no remote exploitation path is described.