In the Linux kernel’s airoha network driver, a null pointer dereference can occur when queue entry or DMA descriptor allocation fails during initialization of an RX queue. The cleanup routine, relying on an early‑initialized descriptor count variable, mistakenly thinks the queue is fully set up and attempts to delete a NAPI object that was never added, causing a dereference. The CVE notes that moving the descriptor count initialization to the end of the queue‑setup routine and ordering page‑pool allocation after descriptor allocation prevents both the null dereference and potential memory leaks.

This vulnerability affects all Linux kernel builds that incorporate the airoha network driver before the fix. The driver is a vendor‑specific piece of the Linux kernel, thus any system running a kernel that includes the airoha driver and has an active airoha network interface is potentially impacted.

The CVSS score of 5.5 indicates a medium severity, and the EPSS score of <1% signals a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The description indicates that the flaw requires a failure in driver initialization, which is likely to be triggered by local or privileged actions involving the airoha device. Based on the description, it is inferred that the null pointer dereference could terminate the kernel, leading to a denial of service.