Based on the description, the likely attack vector is local. The vulnerability is a NULL pointer dereference in the Marvell Embedded Units (mvebu) GPIO driver during system suspend and resume. When a GPIO bank that does not possess PWM functionality is suspended, the driver calls mvebu_pwm_suspend() with a NULL mvpwm field, causing the kernel to dereference a NULL pointer and trigger an oops. The resulting crash terminates the kernel and forces a reboot, which constitutes a denial of service condition. The flaw is a classic NULL pointer dereference (CWE-476) and does not directly provide code execution or privilege escalation, but it does compromise availability for the local system.

The issue affects the Linux kernel on Marvell Armada 370/XP boards that use the mvebu PWM subsystem. Versions of the kernel before the patch that adds a NULL check before calling mvebu_pwm_suspend()/resume are vulnerable. The affected CPE is linux:linux_kernel. Distributions such as Yocto, Debian, or Ubuntu running kernel 6 the mvebu driver should verify whether their kernel build includes the fix.

This vulnerability is a NULL pointer dereference (CWE-476). The CVSS score of 5.5 indicates medium overall severity, primarily affecting availability by crashing the kernel during suspend/resume. The EPSS score of <1% suggests a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local privileged access to initiate a power‑cycle or device suspend, so the risk is moderated by the need for such access.