The cp2615 driver in the Linux kernel incorrectly assumes the USB device serial string exists and uses it as the I2C adapter name. If the string is missing, the driver dereferences a NULL pointer, which can crash the kernel or cause a system panic. The vulnerability is a classic NULL pointer dereference (CWE-476) and does not provide direct remote code execution but can disrupt services by halting the kernel.

The issue exists in all Linux kernels that include the cp2615 driver—for example, kernels 5.13 and 7.0 releases (rc1 through rc7). All Linux kernel variants carrying this driver are potentially affected.

The CVSS score indicates a medium severity (5.5). The EPSS score is very low (<1%), showing that exploitation is uncommon. The vulnerability is not listed in CISA KEV. The likely attack vector is local USB device insertion: an attacker with physical or remote access that can plug in a USB device lacking a serial string may trigger the crash. The fix requires a NULL-check before accessing the string.