The vulnerability arises from a possible null-pointer dereference inside the bcm_vk kernel driver during the bcm_vk_read() operation. When an entry pointer is NULL and the return code is set to -EMSGSIZE, the code attempts to read fields from the null entry, causing a kernel fault. This fault results in a kernel panic and system crash, effectively denying service to all users on the host. The weakness corresponds to a classic null-pointer dereference (CWE-476).

Linux kernel installations that include the bcm_vk driver. No specific kernel version range is listed, so all kernels shipping this driver before the patch are potentially affected.

The CVSS score is 5.5, indicating a moderate severity vulnerability, and the EPSS score is <1%, suggesting a low probability of exploitation currently. The vulnerability is likely exploitable by local users who can invoke bcm_vk_read() (for example, by accessing the /dev/bcm_vk device or using an application that drives it). While local exploitation does not provide remote code execution, it can be used to disrupt availability. The absence of a KEV listing further suggests there are no known active exploits in the wild. Nonetheless, patching remains the recommended action to eliminate the crash vector.