The flaw involves an integer overflow in the Linux kernel’s boot configuration parsing function. An attacker can craft an initrd image with an excessively large bootconfig section, causing pointer arithmetic to wrap around. This bypasses bounds checks and forces the kernel to calculate a checksum over an unrealistic >4GB memory region, leading to unmapped page access and a fatal page fault. The result is a kernel crash during the boot process, effectively denying service to the affected system.

Any Linux kernel device that loads an initrd during boot is at risk until the upstream patch is applied. The specific vendor/product is Linux kernel, and no particular release or version was listed in the advisory. All builds that use the get_boot_config_from_initrd() code are potentially affected.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability can be exploited by an entity able to supply a malicious initrd to the target system—this could occur during system installation or by an attacker who can replace the initrd on a pre‑boot environment. The impact is a denial of service through a kernel crash during early boot. The advisory does not claim privilege escalation. The absence from the CISA KEV catalog indicates the flaw has not yet been reported in the wild, yet the serious nature of an early‑boot crash warrants attention.