The Linux kernel contains a use‑after‑free flaw in the reserved memory subsystem. If the function that allocates the reserved memory array fails, the global pointer ‘reserved_mem’ still references the initdata structure that has already been freed. A later call to the exported function of_reserved_mem_lookup() dereferences this dangling pointer, which can corrupt memory or crash the system.

Linux kernel users whose systems contain the vulnerable reserved_mem implementation. The advisory does not list specific kernel versions, but any kernel before the commit that resets ‘reserved_mem_count’ to zero on allocation failure is affected. Systems that rely on post‑initialization device tree reserved memory lookups are at risk.

The CVSS score is 5.5 and the EPSS score indicates a probability of exploitation below 1%. The vulnerability has not been listed in the CISA KEV catalog, implying no known widespread exploitation. While the low exploitation probability reduces the practical risk, the potential impact—denial of service—justifies rapid remediation.