The vulnerability arises from unbounded recursion in the kernel’s memory allocation free path, caused by cyclic dependencies among kmalloc slab types when allocating obj_exts arrays. This recursion can exhaust the kernel stack and trigger a kernel crash, as observed in a production environment where the stack guard page was hit during repeated __free_slab and kfree operations. The impact is a denial of service via a system reboot or loss of availability, potentially affecting all services running on the affected Linux kernel. The weakness is an unbounded recursion scenario, representing a serious flaw in memory management logic (CWE-835).

All Linux kernel builds that lack the recent fix that introduces the KMALLOC_NO_OBJ_EXT type and related safeguards. The CVE data does not specify any particular kernel version numbers; users should verify if their kernel contains the commit that adds the KMALLOC_NO_OBJ_EXT type. The issue was resolved in the kernel commit that controls obj_ext allocation and prevents cyclical dependencies; any distribution that has not applied this kernel version is vulnerable.

The vulnerability is exploitable through normal kernel operation that engages memory allocation profiling or reuses slab caches. The likely attack vector is inferred from the description as an attacker could trigger the recursion by initiating legitimate processes that allocate and free memory, thereby invoking the free path. Because the recursion occurs during a free path, an attacker does not need special privileges; simply running legitimate processes that trigger allocation and deallocation can lead to a crash. The CVSS score of 7.5 indicates moderate to high severity, but the EPSS score of <1% shows only a very low probability of active exploitation. The absence of a CISA KEV listing and of publicly known exploit code further limits current threat exposure, although the core flaw can still cause immediate outages if triggered.