An issue in the Linux kernel's HID pidff subsystem allows a NULL pointer dereference when conditional effect bits are not properly cleared. The flaw can cause the kernel to crash, resulting in a denial of service. The bug maps to CWE‑824, indicating a loss of error handling and control flow disruption.

The vulnerability affects Linux kernel installations that include the pidff driver before the fix. All current Linux distributions using kernels that have not yet applied the patch are potentially impacted. The exact kernel versions are not listed, so administrators should check the vendor’s release notes for the patch that incorporates the bit‑clearing change.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests the likelihood of exploitation is low. Because the exploit requires interacting with the HID subsystem, the attack vector is likely local or requires privileged access to a malicious HID device. No entry in the CISA KEV catalog means no confirmed widespread attacks are reported. If an attacker can supply a crafted HID signal that triggers the un‑cleared conditional bits, the kernel will dereference a null pointer, leading to a crash.