In the ARM MPAM subsystem of the Linux kernel, a null pointer dereference occurs when a Media Storage Controller that monitors memory bandwidth is taken offline and then brought back online. The restore function fails to initialize a local variable for the counter value, leading to an oops that crashes the kernel and forces a reboot. This vulnerability can disrupt system availability and potentially expose the system to further exploitation if the crash occurs during critical operations.

All Linux kernel releases that include the ARM MPAM subsystem and support MSC bandwidth monitoring are affected. The specific affected versions are not listed, so any kernel prior to the inclusion of the patch that fixes the issue should be considered vulnerable.

The vulnerability can only be triggered by code that controls the offline/online cycle of an MSC, implying local privileged access or hardware-level control. No EPSS score is available and the vulnerability is not in the KEV catalog, but it provides a denial of service through a kernel crash. The lack of a publicly available exploitation technique means the risk is confined to environments where an attacker can exercise the required privilege level.