This vulnerability arises from an unguarded dereference in the dump_reipl function when no IPL parameter block is present. On certain boot scenarios such as HMC FTP boot or QEMU direct kernel boot, the kernel does not receive a parameter block, causing reipl_block_actual to remain NULL. The subsequent code still reads from this NULL pointer, leading to a crash during the standby memory dump process. The kernel therefore hangs and ultimately shuts down, denying availability for the host system.

Linux kernel hosts that have not applied the patch referenced in the commits listed in the advisory are affected. No specific affected kernel versions are listed in the advisory. The fix applies to all current releases of the Linux kernel that include the vendor's patch commits.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of < 1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires the system to boot in a mode that lacks an IPL parameter block, such as HMC FTP or QEMU direct boot. An attacker would likely need local or firmware access to trigger the exact scenario, so the immediate risk is moderate to low in most environments; however the disruption caused by a kernel crash is severe availability.