The fsl‑imx8mq USB PHY driver fails to associate driver data during initialization because platform_set_drvdata() is missing. This deficiency leads to an uninitialized pointer in the driver’s remove() routine, which can be dereferenced when a USB device is detached or the driver is unloaded. The resulting null pointer dereference can cause a kernel panic, producing a local denial‑of‑service. This is an example of a null pointer dereference vulnerability (CWE‑476). Based on the description, it is inferred that the impact is limited to availability rather than confidentiality or integrity.

Any Linux kernel that includes the fsl‑imx8mq USB PHY driver is potentially affected. Based on the description, it is inferred that all distributions shipping this driver code remain at risk until the patch is applied or the driver is disabled. No specific kernel versions are listed, so the risk applies broadly to any affected kernel configuration that loads this module.

The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread known exploitation. It requires local ability to trigger a USB removal or driver unload, so the attack vector is local. With a CVSS score of 5.5, the flaw is of moderate severity. The likely attack vector is a local user or attacker who has permission to power cycle USB devices or unload modules; the vulnerability is not a concern for remote exploitation.