A NULL pointer dereference occurs in the BPF field‑type display routine when the BTF (BPF Type Format) structure supplies an unresolved type table. When a BPF program supplies a type identifier from the system’s base BTF to the printing routine, the kernel dereferences a null pointer and triggers a crash. The crash manifests as a kernel memory fault, leading to a system stop or reboot. This can be leveraged by an attacker who can run custom BPF programs to force the kernel into a fatal state, resulting in a denial of service.

The vulnerability is present in the Linux kernel prior to the patch that implements the guard for missing resolved identifiers. Any distribution or deployment that runs a kernel version containing the unguarded btf_var_show implementation and exposes user BPF APIs can be impacted. Exact version numbers are not provided in the data, so users should check whether their kernel includes the upstream commit that fixes the issue.

The CVSS score is not listed and the EPSS score is unavailable, so the inherent risk is inferred from the nature of the fault. A kernel crash is a severe impact that allows an attacker to disrupt availability. Exploitation requires the ability to load or execute user BPF code, which is typically allowed on systems with open BPF access. The vulnerability is not listed in the CISA KEV catalog, but because it is a kernel null‑pointer dereference, it is plausible that adversaries could target it. The lack of a public exploit does not diminish the need for remediation because a successful crash is a straightforward gain for persistent attackers or as part of a larger attack chain.