The flaw arises because the cros_ec_typec driver fails to initialize its mutex during Thunderbolt registration. When the driver later attempts to acquire the uninitialized mutex, a null‑pointer dereference occurs, triggering a kernel oops and a system crash. This vulnerability is a classic null pointer dereference (CWE‑476) and a use‑after‑free in kernel memory (CWE‑909). The result is a denial of service; there is no evident path to execute arbitrary code or gain escalated privileges.

The issue is present in the Linux kernel’s Chrome OS cros_ec_typec module. All systems that include a kernel containing the unpatched module are potentially affected, including Chrome OS devices and other Linux distributions that ship the same kernel code. No specific version information is provided in the data, so the scope is limited to kernel releases that contain the vulnerable code.

The CVSS score of 5.5 indicates moderate severity, while an EPSS score of <1% suggests a low probability of exploitation. The vulnerability is not included in the CISA KEV catalog, implying no widespread exploitation has been observed. The attack vector is inferred to be local or limited to controllable Thunderbolt devices; an attacker would need to trigger the registration routine, most likely by connecting a Thunderbolt peripheral.