In the Linux kernel's Airoha network driver, an early initialization of the ndesc variable causes a NULL pointer dereference when the queue entry list allocation fails. The defect manifests during the airoha_qdma_init_tx_queue() routine, leading to a crash of the kernel. The impact is a loss of availability, potentially allowing an attacker to destabilize the system if they can trigger the function with failing allocation conditions.

The affected product is the Linux kernel, specifically the Airoha network driver. No specific kernel versions are listed in the information provided, so all kernel builds compiled with the unpatched driver are potentially vulnerable.

The CVSS score is not provided, and EPSS is unavailable, making formal risk assessment difficult. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or remote network traffic that forces the driver to allocate a queue entry list that fails, but the exact exploitation path is not described. The primary consequence is a kernel panic or crash, classifying the risk as a moderate to high denial‑of‑service scenario. Proper mitigation is required to avoid potential service disruption.