During kernel bootstrap on ARM Integrator/CP boards, the interrupt controller initialization routine calls a syscon regmap lookup before the memory allocator is ready. The lookup attempts to allocate memory but fails, returning –ENOMEM or dereferencing a NULL pointer. The resulting kernel BUG and panic occur immediately after boot begins, rendering the system unusable until a reboot is performed. This is a classic NULL pointer dereference (CWE‑476) that forces a local denial of service.

All Linux kernel 6.15 releases and earlier that use the ARM Integrator/CP device tree without the commit that relocates early initialization into standard machine init are vulnerable. This includes all 6.15‑rc1 to rc5 builds prior to the patch, as well as kernel 7.1 release candidates 1‑4 that include the affected code path. The vulnerability applies to any deployment that starts from these unpatched images.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1 % shows that the probability of exploitation is very low. The vulnerability is not listed in the CISA KEV catalog. Exfiltration or remote exploitation is not possible; an attacker must have physical or local access to boot a vulnerable kernel. The crash is deterministic during early boot, providing a simple local denial of service that forces a reboot or manual recovery.