The vulnerability arises from a NULL pointer dereference in the adis driver initialization routine. When the driver initialization runs, it presumes an operation structure is present and immediately dereferences it to inspect function pointers. If that ops pointer is null—as occurs when the driver has not yet provided custom operations—a kernel panic occurs. This outcome results in a loss of kernel stability, effectively denying service to the host. The weakness corresponds to a classic Null Pointer Dereference. Based on the description, it is inferred that the attack vector involves local or privileged interaction with the ADIS driver during its initialization.

All Linux kernel installations that include the IIO IMU drivers for ADIS devices such as adis16480, adis16490, adis16545, and related sensors are affected. The flaw exists in any kernel that incorporates these drivers without the recent patch, regardless of distribution or vendor kernel version. The precise range of affected kernel versions is not specified in the advisory, but any build compiled with the unpatched code is vulnerable.

The CVE description does not specify an attack vector. Based on the description, it is inferred that exploitation requires local or privileged interaction with the ADIS driver during its initialization. The exploit path requires access to the device driver subsystem, which generally implies local or privileged access to the machine. No public exploits or vulnerability exploitation guide are known, and the EPSS score is 0.00022, indicating a very low probability of exploitation, so the likelihood of an attacker successfully leveraging this flaw is uncertain. The issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Nonetheless, the kernel crash could be triggered by a malicious device or software component that interacts with the ADIS sensors, so the risk remains significant for systems that rely on persistent availability. The CVSS score of 5.5 indicates moderate severity.