A race condition in the Linux kernel fsnotify subsystem allows a new mark to be inserted while a connector is being torn down, causing the kernel to dereference a null pointer during a final detach operation. When an unprivileged process performs an fdinfo read concurrently with the detachment, the call to igrab(NULL) triggers a KASAN null‑pointer dereference and can lead to a kernel panic. The bug is a classic example of a synchronization flaw resulting in a use‑after‑free or null‑pointer dereference and manifests as a denial‑of‑service when the system experiences a crash or restart.

The vulnerability affects all versions of the Linux kernel that lack the fsnotify DESTROYING flag patch. No specific release revisions are listed, so any kernel prior to the inclusion of the referenced commit sequence is potentially exposed. The flaw resides in the core kernel and therefore applies to all distributions that ship an unpatched kernel.

Because the EPSS score is not available and the vulnerability is not listed in CISA KEV, the exact likelihood of exploitation is uncertain, but the potential impact is high: a crash of the kernel causes service interruption and may allow an attacker to force a reboot. The race condition can be triggered by any user interacting with inotify watches, so unprivileged users can potentially induce the fault. The lack of a public exploit does not diminish the risk, as the vulnerability requires only normal operation of the inotify subsystem, which is commonly used by many applications.