During the initialization of the Linux kernel register cache helper, an error returned by the populate callback can be overwritten by the exit callback’s return value, if both are defined. The original error is therefore hidden from the caller of regcache_init, making the failure invisible at that point. If the cache is later accessed, this missing error state can cause a null pointer dereference, which will crash the kernel and disrupt all processes on the affected system.

All Linux kernel builds that use the regcache helper with both populate and exit callbacks and have not incorporated the patch found in the referenced git commits are affected. In practice, this includes any kernel version prior to the application of those changes, regardless of distribution. The defect is present in the kernel source tree wherever the regcache infrastructure is compiled in.

The EPSS score is less than 1%, and the vulnerability is not listed in CISA's KEV catalog, suggesting that public exploitation is unknown or limited. The CVSS score is 5.5, which indicates medium severity. Because the error occurs during regcache initialization, the likely attack vector is a local or privileged scenario in which an attacker can cause the driver or subsystem that uses regcache to perform an erroneous populate call. Once the error is hidden, an attacker could trigger use of the cached interface to provoke the crash. The overall threat is moderate to high for systems that allow such low‑level code execution but low for typical end‑users who cannot influence kernel initialization paths.