The flaw occurs in the Shim application of the dp.c library; a missing null pointer check means that if devicepathtostr() returns null, the function is_removable_media_path() will dereference it and cause the system to crash. This crash results in a denial of service for any machine that relies on Shim for its UEFI bootloader. The weakness is a null pointer dereference, as identified by CWE‑476. No path to code execution or data disclosure is indicated in the description.

The vulnerability affects Red Hat Enterprise Linux 7, 8, and 9, as listed by the CNA. The flaw is tied to the shim component used during UEFI boot on those operating systems. No more granular version information is provided beyond the overall RHEL families.

The CVSS score of 3.9 signals low severity, and there is no EPSS data or KEV listing. Exploitation would likely require an attacker to deliver a device path that causes devicepathtostr() to return null, but the specific preconditions are not detailed in the advisory. Because the impact is limited to a crash that interrupts boot, the practical risk appears modest, and no public exploits are documented.