The vulnerability arises from unbounded recursion in the kernel’s memory allocation free path, caused by cyclic dependencies among kmalloc slab types when allocating obj_exts arrays. This recursion can exhaust the kernel stack and trigger a kernel crash, as observed in a production environment where the stack guard page was hit during repeated __free_slab and kfree operations. The impact is a denial of service via a system reboot or loss of availability, potentially affecting all services running on the affected Linux kernel. The weakness is an unbounded recursion scenario, representing a serious flaw in memory management logic.

All Linux kernel builds that lack the recent fix that introduces the KMALLOC_NO_OBJ_EXT type and related safeguards. The issue was resolved in the kernel commit that controls obj_ext allocation and prevents cyclical dependencies; any distribution that has not applied this kernel version is vulnerable.

The vulnerability is exploitable through normal kernel operation that engages memory allocation profiling or reuses slab caches. Because the recursion occurs during a free path, an attacker does not need special privileges; simply running legitimate processes that trigger allocation and deallocation can lead to a crash. The lack of a publicly known exploit code combined with the absence of a CISA KEV listing suggests the probability of active exploitation is moderate, but the core flaw is severe and can cause immediate outages.