The vulnerability originates from the qixis-fpga driver in the Linux kernel. The function devm_regmap_init_mmio() signals failure by returning an ERR_PTR value, yet the driver only checks for NULL. Because a non‑NULL pointer might still be an error value, the driver can dereference an invalid pointer during initialization, leading to a kernel crash and a local denial of service. This flaw reflects incorrect handling of error codes (CWE‑253) and an implicit null pointer dereference (CWE‑476).

Any Linux kernel installation that contains the qixis-fpga driver before the patch is affected. The CNA data lists the kernel as a whole without specific version ranges, so all builds that include the vulnerable code before the fix are potentially impacted.

The EPSS score of < 1% and the absence of a listing in the CISA KEV catalog indicate a low likelihood of public exploitation. The CVSS score of 5.5 reflects moderate severity. Based on the description, the attack vector is inferred to be local: an attacker would need to trigger the hardware initialization or interact with the device in a way that forces the devm_regmap_init_mmio() call to fail. Because the flaw requires a specific error condition, exploitation is not trivial. However, if an attacker can cause the failure, the resulting kernel crash can incapacitate the affected system, making this a notable local denial‑of‑service vulnerability.