A NULL pointer dereference occurs in the Linux kernel’s alps HID driver when it processes a raw event that has not been claimed. The flaw, classified as CWE‑476, can lead to a kernel crash or panic, effectively denying service for the system. The vendor added a guard in commit ecfa6f34492c to ensure the device is properly claimed before processing, preventing the dereference. Based on the description, it is inferred that an attacker could trigger the problematic raw event by sending crafted HID traffic to the device, which would yield the crash.

Any Linux installation that contains the alps HID driver and has not yet incorporated the guard from commit ecfa6f34492c is vulnerable. This includes all kernel releases before that commit, affecting generic Linux distributions that include the alps driver module. The vulnerability affects only the kernel, not user‑space applications.

The CVSS base score of 5.5 indicates a moderate severity. The EPSS score is less than 1 %, suggesting a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, and the fix removes a local denial‑of‑service vector; exploitation would require local access that can deliver raw HID events to the affected driver. Based on the description, it is inferred that the attack vector is local and requires the ability to send arbitrary HID reports to the device.