A NULL pointer dereference occurs in the Linux kernel driver for Intel ISHTP HID devices during a warm reset. The cl->device pointer can be NULL if a reset is initiated while clients are still being enumerated, and the code blindly accesses cl->device->reference_count. This results in a kernel panic, a critical denial‑of‑service condition that can crash or abruptly reboot the affected system. The vulnerability is a classic null‑pointer dereference (CWE‑476) and can potentially allow an attacker to trigger a system crash if they can initiate or influence the reset process.

All Linux kernel releases that contain the unpatched Intel ISHTP HID driver, including the mainstream 6.x series and any earlier kernels that compile the module. The precise affected versions are not listed in the CVE, but the issue was identified during multi‑unit warm reboot stress cycles and has been fixed in recent kernel commits referenced in the advisory. Users running older kernels without this patch are at risk.

The CVSS score is not provided, but the impact of a kernel panic is severe, achieving a high severity assessment. The EPSS score is not available, and the vulnerability is not currently listed in CISA’s KEV catalog, indicating no known large‑scale exploitation. The attack vector is inferred to be a user‑controlled warm reset or a reset triggered by system components while device enumeration is in progress; therefore, privileged users or those able to trigger reboots can exploit the flaw. While the vulnerability is likely to lead solely to denial of service, it represents a critical flaw in kernel stability that must be remedied promptly.