As far as I can tell it appears to be a classic use of an uninitialized pointer.

Are there not static analysis tools routinely used against Linux that should have caught this?

Or runtime memory access detection, like valgrind.

I know both might be slow on a project the size the Linux kernel, but it seems worth it.