A missing null check in the DRM client’s mode‑set probe allows a failure in memory allocation to trigger a null pointer dereference when the code attempts to destroy the partially created mode. This flaw can cause the kernel to crash, resulting in a denial of service. The weakness is a classic CWE‑824 scenario involving premature free or use of uninitialized memory.

The vulnerability affects the Linux kernel’s DRM client module. The CPE string indicates all Linux kernel builds are potentially impacted. No specific kernel versions are listed, so any kernel that includes the DRM subsystem and has not yet applied the upstream patch is vulnerable.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not catalogued in CISA’s KEV list. Based on the description, the likely attack vector is local: a user or process that can trigger the DRM mode‑set path could cause the crash. Remote exploitation is not explicitly supported or required by the data provided.