In the Linux kernel’s TIPC subsystem, binding a large number of local service addresses can eventually hit an internal limit of 65,535 publications. When that threshold is surpassed, protocol service types such as node state and link state are omitted from the name table. Consequently, the name distribution code dereferences a NULL pointer on an empty list, triggering a kernel panic. The crash halts the kernel, making the system unavailable for all users and effectively denying service.

Linux users running any kernel build that includes the TIPC subsystem without the recent patch are affected. The flaw exists in all releases prior to the merge that added unconditional insertion of protocol service types and reduced the maximum local publication count. No detailed version list is provided beyond the generic Linux kernel product.

The EPSS score is not available, so the exact likelihood of exploitation is unknown, but the effect is a severe kernel crash. The vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed large‑scale exploitation yet. An attacker would need to target a system capable of creating many TIPC bindings—either locally or remotely—and drive the subsystem to the publication limit. If successful, the result would be a local or remote DoS caused by kernel panic, leading to complete system disruption.