Based on the description, the likely attack vector is local. The vulnerability is a NULL pointer dereference in the Marvell Embedded Units (mvebu) GPIO driver during system suspend and resume. When a GPIO bank that does not possess PWM functionality is suspended, the driver calls mvebu_pwm_suspend() with a NULL mvpwm field, causing the kernel to dereference a NULL pointer and trigger an oops. The resulting crash terminates the kernel and forces a reboot, which constitutes a denial of service condition. The flaw is a classic NULL pointer dereference (CWE-476) and does not directly provide code execution or privilege escalation, but it does compromise availability for the local system.

The issue affects the Linux kernel on Marvell Armada 370/XP boards that use the mvebu PWM subsystem. Versions of the kernel before the patch that adds a NULL check before calling mvebu_pwm_suspend()/resume are vulnerable. The affected CPE is linux:linux_kernel. Distributions such as Yocto, Debian, or Ubuntu running kernel 6 the mvebu driver should verify whether their kernel build includes the fix.

Based on the description, the exploitability and attack vector are inferred. The flaw has a high impact severity because a single kernel crash during suspend or resume EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local privileged access to trigger a power‑cycle, for example by a user or malicious driver that initiates a power‑cycle. Although the attack vector is local, it can be abused by rogue processes or by an attacker with physical or administrative access, raising the risk to moderate‑high until a patch is applied.