The vulnerability is a NULL pointer dereference in the Linux kernel’s xhci driver that occurs when reading the new portli debugfs files. The bug is triggered if the driver’s recorded maximum port count exceeds the number of ports described by the Supported Protocol capabilities, causing the pointer to a hub port structure to be NULL. Accessing this NULL pointer during a debugfs read results in a kernel crash, which can be used to take the system offline.

All Linux systems using the Linux kernel are affected, since the vendor information lists Linux:Linux as the impacted product. The specific kernel version or release is not indicated in the provided data. Systems that enable the xhci driver and expose the portli debugfs entries are at risk.

Because the flaw results in a kernel panic, the impact is a denial of service that can be triggered locally by accessing the portli debugfs file. The attack vector is inferred to be local, likely requiring privileged access to read debugfs files or a compromised process that can trigger the read. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited recorded exploitation at this time. The CVSS score is 5.5, indicating a medium severity risk, as a kernel crash would disrupt all services on the affected host.