The vulnerability arises from an off‑by‑one loop error and a missing null check in the hp_bioscfg driver’s GET_INSTANCE_ID macro, causing a null‑pointer dereference when sysfs attributes are accessed; this triggers a kernel panic that can force the system to reboot, resulting in a denial of service.

Affected systems include the Linux kernel, specifically release candidates 6.19 rc1 through rc6 as identified by the corresponding CPE strings; no other kernel versions are listed as impacted in the advisory.

The CVSS score is 5.5, placing the issue in the moderate range, while the EPSS score is reported as <1% indicating a very low likelihood of exploitation in the wild. The vulnerability is not included in CISA’s KEV catalog. Exploitation would require local access to trigger a sysfs read via fwupd, suggesting the attack vector is likely local; therefore, the immediate threat level is moderate but the impact of a system crash can be significant for uptime.