A host driver can set the MMC core’s max_segs field to a value that exceeds the maximum representable by a 16‑bit unsigned short. When truncated at assignment, the value becomes zero. The core code then calls kmalloc_objs() with a zero‑size request. In the SLUB allocator kmalloc(0) returns a special ZERO_SIZE_PTR. The subsequent check for a non‑null pointer succeeds, and sg_init_table() attempts to set up a scatter‑list using this placeholder address, which triggers an invalid memory access and causes a kernel panic. The crash manifests as a page‑fault error and exits the system with a kernel Oops. Because this flaw resides in the core MMC subsystem and is triggered by a malformed configuration, any Linux system running a kernel that includes the unpatched mmc_mq_init_request() path is potentially affected. The vulnerability is not limited to a particular distribution or kernel minor version; any build that contains the buggy logic before the commit adding the validation check is at risk. Host or device drivers that provide the offending max_segs value, especially those from third‑party hardware or custom firmware, can trigger the failure. The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, the crash can only be caused by code executing in kernel mode—typically a correctly signed driver or a compromised firmware module. Even though the attack vector is local and requires driver intervention, the resulting denial of service can be catastrophic for embedded devices, servers, or any system where a kernel reboot or hard reset is disruptive. Consequently, the risk is significant, but exploitation likelihood depends on the presence of an untrusted or malicious host driver.

This vulnerability affects all Linux kernel builds that include the unpatched mmc core code referenced in the advisory. Any distribution or custom kernel that ships the buggy mmc_mq_init_request() implementation before the validation change is affected, regardless of kernel version. Host drivers that supply an out‑of‑range max_segs value—particularly third‑party or custom hardware drivers—are required to trigger the flaw.

The CVSS score of 4.4 indicates moderate severity, but the flaw triggers a kernel panic, causing a denial of service. The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likelihood of exploitation depends on the presence of an untrusted or malicious host driver capable of setting an invalid max_segs value. The attack vector is local and requires kernel‑mode code; therefore, an attacker would need to embed a compromised driver or firmware. If such code is loaded, the impact is immediate reboot or hard reset of the affected system.