The Linux kernel’s BPF verifier incorrectly treats the first argument of the sched_process_wait tracepoint as a non‑nullable pointer. A BPF program that does not perform a NULL check can cause the kernel to dereference a NULL value, leading to a kernel panic and system-wide denial of service. The flaw does not grant remote code execution or privilege escalation beyond the ability to load a BPF program, which typically requires CAP_SYS_ADMIN or root privileges. Based on the description, it is inferred that an attacker must be able to load BPF programs, so the exploit is limited to local or privileged contexts.

All Linux kernel releases that have not yet incorporated the patch that marks the sched_process_wait argument as nullable are affected. No specific version range is provided; therefore, any kernel build before the fix, regardless of distribution, is vulnerable.

The CVSS score of 5.5 indicates moderate severity, while the EPSS < 1% points to a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the ability to load BPF programs with sufficient privileges; without such privileges, the flaw cannot be leveraged. The overall risk is thus moderate in environments where untrusted or uncontrolled BPF programs are allowed and where local privileged access is possible.