The Linux kernel contains a NULL dereference in the GUD DRM subsystem that is triggered when a display device is disconnected over USB. During the disconnect sequence, the kernel sets the frame buffer and CRTC pointers to NULL before a commit operation, and the subsequent dereference causes a kernel oops. An unstable kernel crashes, interrupting all processes and rendering the system inoperable until a reboot.

This issue affects any Linux kernel build that compiles the GUD DRM module before the fix was committed. The specific kernel versions affected are not listed in the advisory, so any kernel released before the patch must be considered vulnerable until it is updated to a version that includes the change.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% suggests the likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely local: a user or process that causes a USB display device to disconnect can trigger the crash. An attacker with the ability to manipulate or force USB disconnect events could cause denial of service on the affected host.