The vulnerability resides in the Linux kernel’s BPF subsystem where the sched_process_wait tracepoint receives a PID argument that may be NULL. The BPF verifier assumes the pointer is non‑nullable and therefore allows an unchecked dereference in JIT‑compiled BPF code. When such a program dereferences the NULL pointer, the kernel crashes, resulting in a denial of service. The flaw does not provide code execution or privilege escalation beyond the ability to load or manipulate BPF programs.

All Linux kernel releases prior to the inclusion of the patch that marks the sched_process_wait argument as nullable are affected. The affected distribution is any Linux kernel shipped by any vendor that has not yet incorporated this fix; no specific version range is provided, so the vulnerability applies to all kernels before the patch.

The CVSS score is not supplied, and the EPSS score is unavailable, with no listing in CISA’s KEV catalog. Exploitation requires the ability to load BPF programs with sufficient privileges (e.g., CAP_SYS_ADMIN or other BPF capabilities). Attackers manipulating trusted BPF code can trigger a kernel crash, causing service disruption. The risk is therefore significant for environments where non‑trusted or uncontrolled BPF programs are allowed; however, it is limited to local privilege or the ability to inject BPF code.