The vulnerability arises from a race condition in the Linux kernel’s cpuset subsystem during CPU hotplug operations. When a CPU is taken offline, the kernel updates cpu_active_mask before synchronously notifying the cpuset subsystem, potentially allowing a top-level cpuset to have no active CPUs. This creates a window where guarantee_active_cpus() dereferences a null pointer, leading to a kernel panic and system crash. The weakness manifests as a race condition and null pointer dereference, which can be triggered by privileged users initiating CPU hotplug actions.

All Linux kernel builds that do not contain the patch commit 2125c0034c5d or its successor 7a0aabd9ce69 are affected. The vulnerability applies to the generic Linux:Linux product defined by the CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*.* It does not have a specific version range listed in the data, so any kernel version prior to the aforementioned commits is potentially vulnerable.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating that it may not be actively exploited yet. However, the impact of a kernel panic is severe and the race condition requires only a CPU hotplug event, which can be performed by any user with the ability to administratively online/offline CPUs. The required prerequisites are local kernel access and the ability to trigger hotplugging, so the attack vector is most likely local. Given the lack of active exploitation data and the high severity of a crash, the overall risk is moderate to high, warranting prompt patching.