The vulnerability is caused by SELinux assuming that every boolean value defined in the policy is represented in an internal array. When the declared boolean count exceeds the actual booleans present, NULL entries are left in the array. Functions that iterate over the array then dereference these NULL pointers, which can cause the kernel to crash or corrupt memory. As a result, the flaw primarily poses a denial‑of‑service risk, potentially allowing an attacker to interrupt critical services running on a Linux system that uses SELinux.

The bug is confined to the Linux kernel’s SELinux implementation. Any distribution that builds the kernel with SELinux enabled and constructs policy images containing booleans is affected. No specific kernel versions are listed; the impact extends to all kernels compiled before the commit that introduced the fix.

The flaw is not currently listed in CISA’s KEV catalog and no EPSS score is available, indicating that there is no known public exploit. However, the attack vector is likely local or through crafted SELinux policy material, as the flaw is triggered when SELinux functions iterate over boolean arrays during policy evaluation or manipulation. An attacker could trigger a kernel panic by delivering a policy or boolean configuration that results in a NULL pointer dereference, leading to service disruption or reboot. The severity of the impact makes this a high‑risk issue for any environment running vulnerable SELinux kernels, even though exploitation may require elevated privileges or specific policy conditions.