The Linux kernel’s PlayStation HID driver contains a flaw where the ps_gamepad_create function calls input_ff_create_memless without verifying its return value. If the call fails, the driver later dereferences an uninitialized or null pointer when a force‑feedback effect is triggered, which can cause the kernel to panic. This results in a system‑wide denial of service since a kernel crash halts all processes and requires a reboot. The weakness is a classic unchecked return value leading to null pointer dereference (CWE-252).

All Linux distributions running a kernel version prior to the commit that added the null‑pointer check are affected. Because the bug resides in the generic kernel, any system using an unpatched kernel that ships the PlayStation HID driver is vulnerable, regardless of distribution or patch level.

The advisory does not specify whether elevated privileges are required. Based on the description, it is inferred that the attacker must have local access to attach or inject a PlayStation controller to the target machine. The likely attack vector is therefore local device interaction. If the attacker can trigger a force‑feedback effect via a malicious device, the unhandled error can cause a kernel panic, resulting in a system‑wide denial of service. No CVSS or EPSS metrics are available, and the vulnerability is not listed in CISA’s KEV catalog.