The flaw stems from an ordering issue in the Linux kernel’s NFS server: the DRC hash table is initialized after the shrinker is registered. On weakly‑ordered architectures such as arm64 and ppc, a memory‑pressure scan can see an uninitialized hash table, causing the DRC shrinker callback to dereference a NULL pointer. This results in a kernel panic and a loss of availability for the affected node.

The vulnerability affects all Linux kernel implementations that predate the patch. In particular, systems running arm64 or ppc kernels before the commit that moves bucket initialization and the drc_hashsize store ahead of shrinker_register are at risk. Any distribution using the upstream kernel, or a customized kernel that mirrors that history, is impacted.

The vulnerability is not listed in the CISA KEV catalog and its EPSS score is not available, so current exploit prevalence is unknown. However, a NULL pointer dereference in kernel space typically leads to a panic, which can be considered a high‑severity denial of service. Exploitation would require triggering the kernel shrinker, which may occur under normal memory‑pressure conditions or could possibly be forced by a malicious user with sufficient privilege. The unpredictability of the trigger means that the potential impact is significant but the ease of exploitation is uncertain.