The firmware arm_ffa driver’s bus match callback assumes every FF‑A driver supplies an id_table and dereferences it without validation. When a driver registers with a NULL id_table, a null‑pointer dereference (CWE‑476) occurs, causing a kernel panic and rendering the system inoperable.

All Linux kernel builds that compile the arm_ffa driver without the added null‑check are affected. This includes kernel 5.14 releases (rc1 through rc7), kernel 7.1 releases (rc1 through rc4), and any current or future versions that include the driver without the defensive check.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at this time. The flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker with the ability to load a custom or compromised driver could trigger the vulnerability, leading to a kernel crash. Once the kernel is patched to enforce the id_table contract at registration, the vulnerability is effectively mitigated.