The Qualcomm CCI I²C controller driver contains a NULL pointer dereference in the cci_remove() function when only one I²C master is active. During module removal the code calls cci_halt() for two masters but only initializes the completion for the active master, leading to a dereference of a NULL pointer. This results in a fatal kernel panic, causing a loss of system availability. The weakness corresponds to CWE‑476 – NULL pointer dereference.

All Linux kernels that include the i2c‑qcom‑cci driver on Qualcomm SoCs where only a single I²C master is enabled. Modern Qualcomm platforms that compile the driver into the kernel or load it as a module are affected unless the patch is applied.

The CVSS score of 5.5 indicates medium severity. The EPSS score of less than 1% reflects a very low likelihood of exploitation, and the vulnerability is not listed in CISA KEV. Exploitation would require the ability to unload the i2c‑qcom‑cci module (typically root or elevated privileges), after which a single rmmod command causes a kernel crash. Because the fault occurs only during removal, it is not an easily exploitable remote code execution vector but can be used to disrupt service in situations where an attacker can trigger module removal.