The Linux firmware subsystem for Arm Scmi had a flaw that allowed a NULL pointer dereference when handling notifications for unsupported events. The helper function responsible for retrieving an event handler could return NULL instead of an error pointer, causing code later to dereference this NULL value and crash the kernel. This is a classic null dereference vulnerability (CWE‑476) that results in a kernel OOPS and loss of availability.

All releases of the Linux kernel that contain the arm_scmi firmware subsystem and do not include the commit b5daf93b809d1 (the fix). No explicit vulnerable version range is listed, so any kernel prior to that commit is potentially affected. The vulnerability applies to the Linux:Linux product family.

The CVSS score of 5.5 indicates a medium‑severity condition. The EPSS score of < 1 % shows that the probability of exploitation is very low at present. The vulnerability is not listed in the CISA KEV catalog, which further suggests limited current exploitation activity. The likely attack vector is local, requiring code that can trigger the scm event path; the issue primarily leads to a crash rather than privilege escalation. Overall risk is moderate, with the main threat being denial of service through a kernel crash.