The vulnerability arises from a race condition in the Linux kernel’s cpuset subsystem during CPU hotplug operations. When a CPU is taken offline, the kernel updates cpu_active_mask before synchronously notifying the cpuset subsystem, potentially allowing a top‑level cpuset to have no active CPUs. This creates a window where guarantee_active_cpus() dereferences a null pointer, leading to a kernel panic and system crash. The weakness manifests as a race condition and null pointer dereference, which can be triggered by privileged users initiating CPU hotplug actions.

All Linux kernel builds that lack the patch commits 2125c0034c5d or 7a0aabd9ce69 are affected. This vulnerability impacts generic Linux kernel products. Since no explicit version range is given, any kernel older than these commits could be vulnerable.

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating that it may not be actively exploited yet. The CVSS score of 4.1 reflects a low degree of severity, though the impact of a kernel panic remains serious. The race condition requires only a CPU hotplug event, which can be performed by any user with the ability to administratively online/offline CPUs. The required prerequisites are local kernel access and the ability to trigger hotplugging, so the attack vector is most likely local. Given the limited exploitation potential but the serious system impact, the overall risk is moderate, warranting prompt patching.