The Linux kernel HID plug‑and‑play module fails to report probe errors correctly, resulting in a NULL pointer dereference when force‑feedback (FF) functionality is first used. This bug can cause the system to crash or panic, interrupting all services and potentially requiring a reboot. The crash does not expose sensitive data or allow arbitrary code execution.

Vulnerable systems are Linux kernels that include the HID‑PL subsystem before the fix. The exact affected releases are not listed, but any kernel version not containing the commit that resolves the probe error is at risk. Administrators should review the release notes of upcoming kernel versions for the addressed change.

Based on the description, it is inferred that the likely attack vector is a user or attacker who can use force‑feedback capabilities on a connected HID device, such as a game controller or joystick. In such an environment, triggering the force‑feedback action would cause the kernel to follow a NULL pointer during the first use, leading to a crash. The EPSS score of < 1% indicates a very low probability of exploitation, and the lack of inclusion in CISA KEV suggests no known public exploits. The potential for a kernel panic suggests high impact if the flaw is triggered. The exploitability depends on the attacker’s ability to interact with a HID device that exercises force‑feedback. The CVSS score of 5.5 indicates moderate severity.