The flaw emerges when the lock class registration routine returns a null pointer because the class pool is exhausted, graph_lock fails, or key validation fails. The kernel continues to use this null value directly in pointer arithmetic, corrupting the lock class index. Subsequent lock retrieval operations then dereference an out‑of‑bounds or null pointer, resulting in a kernel crash or, potentially, arbitrary memory corruption that could be leveraged for privilege escalation. The primary weakness is the unchecked null reference.

The vulnerability affects any Linux kernel that incorporates the lockdep subsystem without this null check, across all mainstream distributions. No specific release version is listed, so any kernel build released prior to the patch could be impacted.

The CVSS score for this vulnerability is 5.5, indicating moderate severity, while the EPSS score is < 1%, describing a very low probability of exploitation. This flaw requires the register_lock_class function to return NULL—a scenario that depends on resource exhaustion or module interaction—making exploitation challenging. The most probable attack vector is local, requiring attacker control over the kernel or the ability to influence its lock usage patterns.