A null‑pointer dereference occurs in the Linux kernel's DRBD subsystem when a local read failure triggers the READ_COMPLETED_WITH_ERROR handler, which passes a NULL peer_device to drbd_set_out_of_sync(). The dereference can crash the kernel, resulting in a denial of service. This weakness is a classical null‑pointer dereference (CWE‑476).

The vulnerability is present in the Linux kernel’s DRBD module. No specific kernel releases are listed in the data, so any systems running an affected kernel that has not applied the patch may be impacted.

The vulnerability is not listed in CISA’s KEV catalog and has an EPSS score below 1 %, indicating very low probability of exploitation in the wild. The exploit would require triggering a local read error on a DRBD device, which is likely only achievable by an attacker with local or kernel‑level access to the host. Consequently, the threat surface is limited to privileged or local attackers, and remote exploitation does not appear feasible based on the available information.