The Linux kernel k230 pinctrl driver contains a bug that executes a NULL pointer dereference during device-tree parsing in k230_pinctrl_probe. The code attempts to access info->pctl_dev->dev before info->pctl_dev is initialized, causing an immediate kernel crash. The crash indicates that any process loading the driver during boot or module insertion will be disrupted, leading to system unavailability for all services.

The flaw resides in the k230 pinctrl driver that is part of the mainline Linux kernel. All distributions that ship a kernel including this driver before the patch may be affected; no specific version numbers are supplied, so any kernel with the unpatched driver is potentially vulnerable.

EPSS score is <1%, indicating a very low likelihood of real-world exploitation, and the CVSS score of 5.5 signals moderate severity. Exploitation requires local modification of the device-tree or boot process that triggers the probe, so the attack vector is inferred to be local. While the primary impact is a denial of service, the lack of known exploitation activity means the vulnerability remains theoretical until a local attacker gains the required control. Patching mitigates all risk.