A NULL pointer dereference occurs in the Adreno graphics driver for the Linux kernel when userspace requests Unified Bandwidth Control (UBWC) parameters on a2xx‑to‑a4xx GPUs. The driver assumed UBWC support existed, and without a guard check it dereferences a null pointer, leading to a kernel panic. The result of an attacker triggering this path is a denial of service through a system crash.

Linux kernel DRM msm Adreno driver installations that include hardware series a2xx through a4xx GPUs are vulnerable. The issue exists in all kernel releases that contain the unpatched driver code, regardless of distribution or specific patch level, until the merge that adds a check for UBWC configuration in adreno_get_param is applied.

The CVSS score of 5.5 reflects a moderate severity that can bring the entire system down. The EPSS score of less than 1 % and absence from the CISA KEV catalog suggest a low probability of widespread exploitation, yet the vulnerability can be exercised by any user who can open the relevant DRM device node to query UBWC parameters. The exploit does not require elevated privileges beyond normal DRM access rights, so a local user can trigger the crash by invoking the vulnerable ioctl.