The vulnerability originates from a missing initialization of the mutex in cros_ec_typec's Thunderbolt registration routine. When an attacker successfully triggers the registration process – for example by connecting a crafted Thunderbolt device – the subsequent attempt to lock the uninitialized mutex results in a null‑pointer dereference, causing a kernel oops and system crash. This flaw is classified as a null‑pointer dereference (CWE‑476) and an improper initialization (CWE‑665). The consequence is a denial of service; no arbitrary code execution is possible.

This issue affects the Linux kernel's Chrome OS cros_ec_typec driver, which is part of the platform/chrome subsystem. Any system – including Chrome OS devices or distributions that ship a kernel containing the unpatched cros_ec_typec module – can be impacted if Thunderbolt support is enabled. The vulnerability does not require any user‑level privileges beyond the ability to trigger the registration routine via a Thunderbolt device.

The CVSS score is not provided and the EPSS score is unavailable, making it difficult to quantify the exact severity. The vulnerability is not listed in CISA’s KEV catalog, suggesting that no widespread exploitation has been observed. Because the flaw requires direct interaction with the Thunderbolt subsystem, the attack vector is local or requires the attacker to control the device connecting to the target. The risk is therefore moderate and primarily limited to causing a system crash rather than enabling remote code execution.