In the Linux kernel, a NULL pointer dereference occurs in the ufshcd_add_command_trace function of the UFS core driver. When the hardware queue pointer returned by ufshcd_mcq_req_to_hwq is NULL, the driver accesses its id field and causes a kernel panic. This results in a system crash without any external data disclosure or privilege escalation beyond the crash.

All Linux kernel builds that include the legacy UFS core driver and lack the commit adding the null‑check are affected. This includes kernels supporting multiple‑queue UFS modules, such as Mediatek's ufs_mediatek_mod. The vendor is the Linux kernel project; any version prior to the patch implementing the check is vulnerable.

The CVSS score is 5.5 and no EPSS score is available, so quantitative risk is uncertain but indicates moderate severity. The vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation. The likely attack vector is local: a user that can generate UFS I/O requests may trigger the crash. Because the defect leads to a kernel panic, it is considered a denial of service if the fault can be invoked. No exploitation beyond denial of service is documented in the provided data.