The vulnerability is a null pointer dereference in the Linux kernel AFS filesystem code. When the afs_get_tree function is called, it fails to verify that the pointers to the cell and volume structures are non‑null, resulting in a KASAN error and a kernel Oops. This causes the kernel to crash, leading to an interruption of system operations. The flaw does not provide direct code execution but can be considered a critical denial of service threat to system availability.

The flaw exists in the Linux kernel’s AFS (Andrew File System) implementation. It applies to all kernel builds that contain the unpatched afs_get_tree implementation. Precise version ranges are not specified in the advisory, but the vulnerability was discovered in a 5.10.246-syzkaller build and was fixed in later kernel releases. Systems running kernels prior to the commit that introduced the fix are considered vulnerable.

With a CVSS score of 5.5, the vulnerability is considered medium severity. The EPSS score is less than 1%, indicating a very low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. The kernel crash indicates that the issue can only be triggered through manual or automated mounting of AFS, which generally requires administrative access. Although there is no known public exploitation, a local attacker could still cause a denial of service by forcing the kernel to crash.