The vulnerability is a null pointer dereference in the Panthor DRM driver during the panthor_fw_unplug() routine. If a device is removed or the firmware is not loaded, the driver may attempt to dereference a pointer that is not initialized, causing the kernel to crash. This leads to a loss of system availability.

The issue exists in the Linux kernel’s DRM Panthor driver, which is built into all distributions that provide that driver. All kernel releases that ship the Panthor driver are potentially affected until the patch is applied.

There is no CVSS score or EPSS data available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local; an attacker would need to trigger an unplug event or force a power cycle of the device while the kernel is running. Because the fault occurs in kernel space, the exploit can cause a system crash, which is highly disruptive but does not provide direct code execution to a remote adversary.