The Linux kernel function remove_nh_grp_entry() dereferences an uninitialized extack pointer when a listener fails to replace a reduced nexthop group. In the affected code path, drivers such as netdevsim and mlxsw do not set an extack message on allocation failures, causing the kernel to dereference a stack pointer that has never been initialized. This use-of-uninitialized-variable flaw can corrupt kernel memory and crash the system.

All Linux kernel releases that contain the vulnerable nexthop implementation before the patch commit are potentially affected. The fix was introduced in commits 030c878eaedf0449e2b5401a0a0146d0afcc645e and 6347c5314cee. Therefore any system running a kernel older than the version that incorporates these commits, regardless of Linux distribution, is at risk.

The CVSS score is 5.5 and the EPSS score is < 1%. While no public exploit is known, the failure to initialize extack can lead to corruption of kernel memory. The vulnerability remains of moderate severity and is considered non-trivial to exploit. The likely attack vector is local or through a manipulated network driver component that induces allocation failures. The vulnerability is not listed in CISA’s KEV catalog.