A race condition in the Qualcomm SLIMBus NGD controller driver of the Linux kernel allows callbacks to be registered and invoked before the NGD device is fully initialized. When an interrupt or remote‑processor start occurs concurrently with the driver probe, the driver may attempt to use a NULL pointer, leading to a kernel panic during boot or system instability. This flaw is a classic null reference error (CWE‑476) that can prevent the board from booting. The vulnerable code resides in the slimbus/qcom‑ngd‑ctrl module, which is loaded on Qualcomm platforms that use the SLIMBus interconnect. The kernel’s remoteproc subsystem may start in parallel with this driver, and the SSR and PDR registration logic is executed too early, exposing uninitialized data structures. Based on the description and the nature of the flaw, the likely attack surface is limited to the kernel’s boot or firmware initialization phase. An attacker would need to control the timing of remote‑processor startup or trigger hardware interrupts at a precise moment, a scenario typically restricted to privileged firmware or an attacker with physical access to the device. The EPSS score shows <1 % probability, and the vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploits and a low exploitation likelihood.

Linux kernel builds that include the slimbus/qcom‑ngd‑ctrl module for Qualcomm devices are affected. The CNA does not pin specific kernel releases; therefore any kernel version that has not incorporated the upstream patch and still loads this module during startup is vulnerable. Devices that omit this module, or that run a patched kernel, are not at risk.

The low EPSS score and absence from KEV suggest that exploitation is unlikely in the wild. However, if an attacker can influence the remote‑processor initialization order or force hardware interrupts while the driver is probed, they could trigger a kernel panic and achieve a denial‑of‑service. Successful exploitation would require privileged control and could impact the entire system, preventing normal boot and operation.