The staging greybus lights subsystem in the Linux kernel contains a flaw that triggers a NULL pointer dereference during module cleanup. When the memory allocation for channel structures fails, the cleanup routine still reads the channel count and dereferences a NULL pointer, causing a kernel panic and rebooting the system. This results in a loss of availability for the affected host.

The vulnerability affects any Linux kernel build that includes the greybus staging lights module and has not yet applied the upstream fix, which reorganizes allocation to avoid a NULL reference. The issue is present across all Linux distributions because it resides in the upstream kernel source, so all vendors that ship a kernel containing this module are impacted.

The EPSS score is not reported and the flaw is not listed in CISA’s KEV catalog, indicating no documented large‑scale exploitation. The attack vector is inferred to be local or involve direct interaction with a greybus device over USB; an attacker could trigger the failure by forcing allocation failure during a module unload. Without a CVSS rating, the overall risk is uncertain, but a kernel crash that renders the system unusable justifies immediate attention.