The vulnerability exists in the remoteproc driver for Xilinx SoCs, where a receive callback accessed buffer information without first confirming that the incoming message was non‑NULL. This unchecked dereference can trigger a kernel panic, effectively causing a denial‑of‑service condition. The weakness is a classic null‑pointer dereference, classified as CWE‑476.

All Linux kernel releases that contain the remoteproc/xlnx driver without the patch are affected. No specific version range is listed, so any kernel version prior to the application of the fix should be considered vulnerable.

The issue has not been demonstrated in public exploits and is not listed in CISA’s KEV catalog. Exploitation would require an attacker to send a crafted IPI message that results in a NULL pointer dereference, leading to a crash. While no elevation of privilege or remote code execution is implied, the potential for a kernel panic provides a moderate risk, especially in environments where IPI traffic can be manipulated. No EPSS score is available, so the likelihood of exploitation cannot be quantified precisely.