This vulnerability causes an uninitialized clkevt instance to be used during a read_current_timer call on ARM32 platforms where the SP804 timer is not configured as the sched_clock. The read attempts to access a NULL pointer, producing a kernel Oops that brings the system down. The impact is a loss of availability, as the crash can force a reboot or lock the machine until a restart. No information indicates that an attacker can gain code execution or compromise confidentiality or integrity.

The issue affects Linux kernel releases on ARM32 devices that use the SP804 timer when the kernel’s sched_clock is not enabled for that device. The specific affected kernel versions are not listed in the CVE data, but the problem is present in any build that contains the sp804 driver before the patch from commit 693b0b594b0f278bafa784984129c0c0f988e352. Devices that rely on SP804 for delayed timers and have a device tree entry that does not set use_sched_clock to 1 are most at risk.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score is less than 1%, suggesting a low probability of exploitation. The vulnerability leads to an Oops, which is a local, kernel‑level impact. It is not recorded in CISA's KEV catalog. An attacker with local, privileged access could trigger the crash by invoking a function that calls read_current_timer while the SP804 timer is uninitialized. Without such local privileges, the vulnerability remains unlikely to be exploitable. The risk is primarily a denial of service under these conditions.