The Linux kernel contains a NULL pointer dereference in the function check_flush_dependency() when a kworker that is not executing a work item calls it as part of the out‐of‐memory handling path. The dereference of worker->current_pwq, which is NULL outside of a work item, can trigger a kernel panic, causing the system to reboot. This is a classic NULL pointer dereference (CWE‑476). The analysis that the vulnerability requires local kernel code execution is an inference based on the described execution contexts, as the description does not explicitly state the attack vector.

The kernel flaw exists in any Linux kernel build that does not yet contain the commit that guards worker->current_pwq against NULL. This has been inferred from the description, which states the issue was fixed by a patch applied to the mainline repository. Therefore all current LTS and mainline releases prior to that commit are considered potentially affected.

The CVSS score of 4.7 and the EPSS score of < 1% point to a moderate severity vulnerability with a low probability of exploitation in the wild. The flaw appears to require local kernel execution by triggering the out-of-memory path, which is inferred from the OOM notifier and worker allocation sequence described. The vulnerability is not listed in the CISA KEV catalog. If exploited, the impact would be a denial of service through a hard kernel panic and system reboot.