The vulnerability arises in the Linux kernel BPF subsystem, where the functions bpf_set_dentry_xattr and bpf_remove_dentry_xattr attempt to lock the inode of a supplied dentry without verifying that the inode is not null, causing a NULL pointer dereference (CWE-476). If a negative dentry is passed, the inode field is null and the lock call triggers a null pointer dereference, leading to a kernel crash. The same flaw exists in xattr permission checks, where a negative dentry could trigger a warning via WARN_ON, potentially leading to a panic on systems configured with panic_on_warn, which is equivalent to a denial‑of‑service condition. The damage is confined to the affected kernel, resulting in loss of availability for the host system.

All Linux kernel implementations are affected, with the issue present in any kernel build that has not applied the patches referenced in the advisory. The exact version range is not specified, but the bug was fixed in the commit 0160edf2af51c5fde742973742c5d10497901b21 and subsequent related patches.

The vulnerability does not appear in the CISA KEV catalog and has an EPSS score of less than 1 %, indicating that exploitation is unlikely or untracked. The CVSS score of 5.5 classifies the issue as medium severity; it can trigger a kernel crash that results in a denial‑of‑service for the affected host. It is inferred that a local attacker with sufficient privileges could provoke the crash via malicious BPF programs that reference negative dentries, though no widespread exploitation has been reported.