A NULL pointer dereference occurs in the Linux kernel when the COMPAT kfunc wrappers scx_bpf_select_cpu_and() or scx_bpf_dsq_insert_vtime() are invoked for a task whose scheduler pointer has been cleared, such as after the task has exited or when it is an idle task. The unguarded dereference in scx_vexit() triggers a kernel Oops, which can lead to a system crash and therefore a denial of service. The flaw does not provide direct privilege escalation or data exfiltration; its primary impact is the forced kernel failure.

Linux kernel builds that include the sched_ext sub-scheduler feature and have not yet incorporated the one-liner fix for the NULL dereference. The vendor list is Linux, covering all distributions that ship a kernel version containing the vulnerable wrappers. No specific affected version range is published, so any kernel that still contains the unguarded wrappers before the patch is considered at risk.

The CVSS score is 5.5, indicating medium severity. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of current public exploitation. Based on the description, it is inferred that a local attacker with kernel or root privileges could execute a BPF_PROG_TYPE_SYSCALL program that targets the vulnerable wrapper on an exited or idle task. The likely attack vector is local. Because a single trigger will cause the kernel to Oops, the impact is high, but the overall risk remains modest due to the restricted privilege requirement for the attack.