In the Linux kernel framebuffer console (fbcon) subsystem, the function fbcon_open() can call con2fb_acquire_newinfo() and, if that function fails, the returned pointer remains null. Subsequent dereferencing of this NULL pointer causes a kernel panic. The flaw results in a denial of service that forces the kernel to halt or reboot, affecting availability but not confidentiality or integrity. It exemplifies the weaknesses CWE-252 (Missing Return Value Check) and CWE-476 (Null Pointer Dereference). The likely attack vector is local console or framebuffer operations, inferred from the description.

The CVE record does not specify any affected kernel version range; therefore it is unknown which releases contain the vulnerable code path. Administrators should verify whether their running kernel includes the fbcon code branch that was patched in the commit referenced in the CVE. All kernels built from source that include the pre‑patch fbcon implementation could potentially be affected, but no exact version data is provided.

The CVSS score is 5.5 and the EPSS score is less than 1%, indicating a moderate severity but a low likelihood of exploitation. The flaw can only be triggered locally by an attacker able to perform console or framebuffer operations, such as opening /dev/fb* or forcing a console switch. Based on the description, the likely attack vector is local. Because the vulnerability is not listed in the CISA KEV catalog, immediate widespread exploitation is not expected, yet the kernel crash impact warrants timely remediation.