A null pointer dereference occurs in the Panthor DRM driver during the panthor_fw_unplug() routine when the firmware is not loaded or the MCU is in an arbitrary state. This flaw causes the kernel to crash, which results in a loss of system availability. The weakness is classified as CWE-824.

The vulnerability is present in the Linux kernel’s DRM Panthor subsystem. Any distribution kernel that includes the Panthor driver is potentially affected until the patch that removes the erroneous null dereference is applied.

The EPSS score is less than 1 %, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting that no publicly known exploits are available. The likely attack vector is local: an attacker must trigger a device unplug event or otherwise force the driver to execute panthor_fw_unplug() while the firmware state is uninitialized. Exploitation would lead to a kernel panic, but it does not provide elevated code execution beyond causing a denial of service.