The aarp_send_ddp function calls atalk_find_dev_addr without checking the returned pointer for NULL. When a device has no AppleTalk interface configured, the dereference of a NULL pointer occurs in kernel space, causing a kernel panic. This shutdown renders the host unusable until reboot. The flaw is a classic null‑pointer dereference (CWE‑476) that does not provide code execution but results in a denial of service.

Any Linux kernel containing the unpatched aarp_send_ddp implementation is affected, irrespective of distribution. The bug resides in the net/appletalk subsystem; the upstream commits 83899a056aeb120898a6e3a989971fc63e274e2e, 8fc30f0cdf4207a5aa2341c0a98d0f1713b3ce2c, and 9e7f36ab5b7bf68463faa5f7b926fea8f35597bb introduce the needed NULL check. Kernel versions built after these commits are not vulnerable.

The CVSS score is 5.5, indicating a moderate severity that can bring down the entire system. The EPSS score of <1% shows a low likelihood of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is inferred from the description: an attacker who can cause the kernel to process AppleTalk traffic—by sending crafted AppleTalk packets or exercising privileged system calls—might trigger the crash. Because AppleTalk is rarely used and typically limited to specific network contexts, the opportunity for exploitation is limited, but the impact remains a full denial of service if an exploit succeeds.