A NULL pointer dereference occurs in the BPF field‑type display routine when the BTF (BPF Type Format) structure supplies an unresolved type table. If a BPF program supplies a type identifier for a BTF_KIND_VAR from the system’s base BTF to the kernel’s print routine, the kernel dereferences a null pointer in btf_var_show, causing a kernel crash and system stop or reboot. The crash manifests as a KASAN error indicating a user-memory-access violation. This denial‑of‑service flaw occurs within kernel space, affecting the integrity and availability of the affected system.

The vulnerability is present in any Linux kernel version that contains the unguarded btf_var_show implementation and does not yet include the fix that checks for a NULL resolved_ids pointer. Exact kernel versions are not listed in the CVE data; therefore, any distribution running an unpatched kernel prior to the upstream commit is potentially impacted. Users should verify whether their installed kernel includes the patch that adds the guard for missing resolved identifiers.

The CVSS score of 5.5 and EPSS score of < 1% indicate a moderate severity and a low probability of exploitation. Exploitation requires the ability to load or execute BPF programs that reference a base BTF variable; such programs are typically allowed for privileged or local users. The vulnerability is not listed in the CISA KEV catalog. While no public exploit is available, a successful crash is a straightforward denial-of-service gain. The likelihood of exploitation is inferred to be low unless an attacker already has the capability to load BPF programs on the target system.