The flaw resides in the Linux kernel’s SELinux subsystem. The function security_get_classes allocates an array according to declared policy classes but writes each entry at index class‑value minus one. When a policy references a class that the kernel has not claimed, the lookup returns a NULL pointer. The subsequent use of this pointer in sel_make_dir and d_alloc_name produces a null‑pointer dereference that crashes the kernel. Based on the description, the impact is a system‑wide denial of service because the crash forces a reboot or lock‑up.

All Linux kernel releases that contain the unguarded security_get_classes logic are affected. The specific list of affected kernel versions is not provided, so the risk applies broadly to any distribution shipping a kernel with the vulnerable code. Conforming SELinux policies that define every class they declare remain safe, while misconfigured or malicious policies that reference undefined classes can trigger the crash.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker who can influence the SELinux policy—either by loading a crafted policy or by modifying existing policy files—can trigger the fault. The attack vector is local, requiring privilege to alter or overwrite policy files. Exploitation is straightforward because the kernel fails the lookup without a guard, so a single malicious or misconfigured policy reference is sufficient to cause a denial of service.