The vulnerability is a null pointer dereference in the function that frees a device in the auxdisplay line‑display subsystem. When the attachment list has already been pruned, the helper that locates the containing object returns NULL and the subsequent dereference aborts the kernel, producing a system crash. The only consequence stated is a loss of availability; no evidence of privilege escalation or data modification is provided.

The affected code exists in the Linux kernel; the CPE list covers all kernel releases, including early releases of 7.0 RC1 through RC6. No specific version numbers are supplied, so any kernel that includes the auxdisplay/line‑display components and has not yet received the patch is vulnerable until the fix is applied.

The CVSS score of 5.5 indicates a moderate severity and the EPSS value of <1% reflects a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalogue. The error is triggered during the device release phase, so the likely attack vector is a local or privileged process that can cause the device to be detached or that experiences an error path during registration. Because the description does not mention remote or other vectors, the exploitability is confined to processes that have the capability to invoke the release callback.