alloc_workqueue() can return NULL on memory allocation failure; the PCI endpoint driver does not check for this and later calls queue_work() with the NULL pointer in epf_ntb_epc_init(). This missing NULL check can cause a null pointer dereference that crashes the kernel, leading to an immediate system reboot. The impact is a denial of service, as the kernel becomes unstable and lost control of the machine.

All Linux kernel builds that include the PCI_endpoint driver lacking the NULL check are affected. The input does not specify exact kernel version ranges; therefore any kernel version that uses this driver before the patch may be vulnerable.

The EPSS score of 0.00024 indicates a very low likelihood of exploitation. The vulnerability is a Null Pointer Dereference (CWE-476), and the risk is high because a kernel panic can compromise availability and, if the crash can be triggered repeatedly, may facilitate further privilege escalation. The likely attack vector is local or device-based: an attacker who can inject a PCI endpoint device or is able to force the driver to load on a target system could trigger the allocation failure and crash the kernel. The CVSS score of 5.5 indicates medium severity.