The vulnerability lies in the Linux kernel’s media subsystem (v4l2‑async). It is triggered when an asynchronous device binding fails: the kernel may dereference an uninitialised or already freed pointer after the async connection is removed from the device’s list, causing a kernel page fault that typically crashes the system. This manifests as a denial‑of‑service. The weakness corresponds to CWE‑476 (Null Pointer Dereference).

Any Linux kernel installation that contains the v4l2‑async code before the patch referenced in the advisory URLs is vulnerable. The flaw is present in the generic kernel as shipped to most distributions, and no explicit version range is cited in the CVE. Users running an unpatched kernel and using media drivers that invoke async binding are at risk.

The CVSS score of 5.5 indicates moderate severity, while an EPSS score of less than 1% reflects a low probability of exploitation in the wild. The vulnerability is not recorded in the CISA KEV catalog. Attackers would need to trigger faulty async matching, typically by initiating media operations or by loading a media driver that performs asynchronous binding. With local or privileged access, this could cause a kernel crash that effectively denies service to all users on the machine. The fix is available in upstream kernel commits; updating to a kernel that contains those commits mitigates the risk.