The Cadence cdns‑mhdp8546 graphics bridge driver in the Linux kernel contains an oversight that can result in a null pointer dereference when the driver enters a recovery routine after a mode‑setting failure. The flaw occurs during the atomic_enable() phase, where the driver attempts to access a mutex through a connector pointer that has not yet been initialized. Consequently, dereferencing this null connector causes the kernel to crash, producing a severe impact. This defect does not involve external input or authentication; it is a local kernel bug triggered by mode‑setting errors that can occur during normal driver operation or when software configures display modes.

This vulnerability affects Linux distributions that ship the Cadence cdns‑mhdp8546 graphics bridge driver in the kernel. The affected releases are those that include the driver prior to the patch that sets the connector pointer in atomic_enable(). Any kernel containing the unpatched driver may be vulnerable.

The CVSS score is 5.5. The EPSS score of < 1% indicates that the probability of exploitation is very low. The vulnerability is not listed in the CISA KEV catalog. The flaw can lead, causing a reboot or loss of graphical service. Exploitation requires a mode‑setting error that triggers the driver’s recovery path, which suggests a local‑interaction attack vector. The severity of a kernel panic warrants prompt attention despite the low exploitation likelihood.