The arm_mpam subsystem in the Linux kernel calls __destroy_component_cfg() to free a configuration array. If mpam_disable() is invoked before the array has ever been allocated, the function dereferences a NULL pointer, causing a kernel panic and taking the system offline. This is a classic null‑pointer dereference vulnerability (CWE‑476), resulting in a denial of service.

All Linux kernel releases that include the arm_mpam driver on ARM‑based architectures are potentially impacted, including early releases such as kernel 7.1 RC1‑RC3 and any distribution kernels that have not applied the fix. The vulnerability applies to generic Linux kernels regardless of distribution vendor.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of <1% suggests a low likelihood of exploitation. The CVE is not listed in the CISA KEV catalog and no public exploits are known. The likely attack vector is local; an attacker with sufficient privileges to invoke mpam_disable—such as the root user or a user with elevated capabilities—could trigger the crash. Remote exploitation would require physical access or a more advanced attack that enables execution of the mpam_disable path.