In the Linux kernel, an error in the auxiliary bus code causes a NULL pointer dereference during cleanup of a failed auxiliary_device_add. The missing return statement allows the uninit routine to execute and free the auxiliary device structure, after which the code touches stored fields of the now‑NULL structure, leading to a kernel crash. This flaw involves a null pointer dereference (CWE‑476) and a missing return control flow error (CWE‑908) that results in a denial of service by causing the kernel to panic. The vulnerability does not provide a direct path for privilege escalation or data exfiltration; its primary impact is loss of availability.

All Linux kernels that include the auxiliary bus implementation and have not applied the commit that adds the missing return are affected. No specific version list is provided, so any kernel prior to the patch is considered vulnerable.

The EPSS score is reported as less than 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a very low probability of prevalence in the wild. Exploitation would require local privileged code path to trigger the failed auxiliary_device_add, which is unlikely in most deployments. The high impact of a kernel crash makes prompt remediation important, but the low likelihood reduces urgency for environments that cannot immediately update the kernel. The CVSS score of 5.5 indicates moderate severity.