The vulnerability causes a null pointer dereference in the function that checks for huge page usage of a vmalloc area. If a caller passes an address that is not a valid vmalloc mapping, the helper that retrieves the area may return NULL. The subsequent dereference results in a kernel crash, interrupting operating system services and potentially bringing the system down. This flaw permits an attacker to produce a denial of service by forcing the kernel to panic.

The flaw is present in the Linux kernel itself; no specific kernel release numbers are listed in the data, so it could affect any version that has not applied this patch. The affected vendor is the Linux kernel project.

The exploit requires initiating a path that ultimately calls the vulnerable helper with an invalid address, which normally only privileged or local code can do. The vulnerability is not listed in CISA’s KEV database, and its EPSS score is < 1 %, indicating a very low probability of exploitation in the wild. The CVSS score of 5.5 reflects a medium severity denial‑of‑service impact, as a kernel crash will interrupt operating system services. No remote exploitation path is documented; the attack remains effectively local.