A NULL pointer dereference occurs in the Marvell Prestera network driver when devlink_alloc() fails during device initialization. The driver unconditionally calls devlink_priv() on the returned pointer, which is NULL upon allocation failure. This causes a kernel crash, resulting in a denial of service that may bring down the host or require a reboot. The weakness is classified as CWE-476, indicating a null pointer dereference vulnerability.

Linux kernel implementations that include the Marvell Prestera driver. Affected releases include kernel versions up to at least 6.19 release candidates, as reflected in the common platform enumeration strings. All systems running kernel code with this driver are potentially impacted, regardless of the Debian, Ubuntu, or other distribution distribution, provided the device is present.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is local to the host; an attacker with ability to influence network traffic to a device on a system with the Prestera driver could trigger allocation failure. The crash can lead to a system reboot or kernel panic, causing service disruption.