The kernel function ras_core_get_utc_second_timestamp() incorrectly accesses ras_core->dev when the preceding condition fails, allowing a NULL pointer dereference if ras_core is null. This flaw can cause the kernel to crash, resulting in a denial‑of‑service condition for the system. This is a NULL pointer dereference. The vulnerability originates from a lack of an early NULL check and was addressed by inserting such a check and returning zero when ras_core is invalid. The flaw appears to be exploitable only when the function is invoked in kernel context, such as during RAS error event handling, so an attacker would need local or kernel‑level privileges to trigger it. The likely attack vector is an internal kernel call chain rather than an external network interface.

Linux kernel implementations produced by the Linux Foundation. Specific version ranges affected are not listed in the CVE data; the flaw exists in kernel code prior to the patch commit referenced in the provided Git links.

The CVSS score is 5.5, the EPSS score is < 1%, and the vulnerability is not listed in CISA KEV. Because the vulnerability requires triggering a kernel function that may be exercised during normal RAS operations, it is considered a local privilege or kernel breach risk, leading to a crash and denial of service. Exploitation would likely be limited to a system where the attacker already has the capability to cause the function to run with a NULL ras_core pointer, such as by tampering with device state or making specific kernel calls.