A null pointer dereference in the Linux kernel’s pfcp driver occurs when pfcp_newlink creates a UDP socket before the network device is registered. If the registration fails, the cleanup path releases the socket again, causing a dereference of a NULL pointer that triggers KASAN and a kernel panic. The flaw leads to a crash rather than arbitrary code execution or privilege escalation.

The vulnerability appears in all Linux kernel builds that compile the pfcp driver. Because the problematic code exists in current kernels until the official patch is applied, any recent kernel containing pfcp_newlink is potentially affected. Specific version ranges are not enumerated, so all kernels that expose this driver are at risk.

With a CVSS score of 4.7 the flaw carries a moderate severity, while the EPSS score of less than 1% suggests the likelihood of exploitation is low. It is not listed in the CISA KEV catalog. The likely attack vector is to trigger the bug locally or from remote through a netlink command that attempts to create a pfcp device and then forces the registration to fail. Successful exploitation results in a kernel crash that causes a loss of availability for the affected system, but does not grant the attacker code execution or elevated privileges.