A NULL pointer dereference in the Linux kernel’s cpufreq intel_pstate module triggers a kernel panic when users disable Intel Turbo Boost via the /sys interface while the system is booted with CPU limits such as nosmt or maxcpus. The crash forces a system reboot, disrupting availability but does not expose data or enable arbitrary code execution.

The vulnerability affects the Linux kernel in all distributions that ship the default kernel source. It applies to kernel versions that have not integrated the fix that reorganizes the maximum frequency update handling. No specific version range is published, but any kernel before the commit that corrected the dereference is potentially vulnerable.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1 % points to a low probability of exploitation. The flaw requires local access and root privileges to trigger the disabling of turbo through the sysfs interface, limiting the risk of remote attacks. It is not listed in the CISA KEV catalog, and no widespread public exploits have been reported, though an unpatched kernel could experience unexpected crashes during normal operation.