A null pointer dereference occurs in the firmware/arm_ffa bus match callback when a driver registers without providing an id_table. The callback assumes an id_table is always present and dereferences it unconditionally, causing a kernel panic if the table is NULL. The immediate consequence is a system crash that renders the operating system unavailable, constituting a denial‑of‑service attack.

The vulnerability affects all Linux kernel builds that include the arm_ffa driver without the null‑check. Because the arm_ffa subsystem is used on any architecture that supports Firmware‑Flat System (FF‑A), the impact is broadly applicable across current and future kernel releases until the patch is incorporated.

The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating a low likelihood of exploitation at this time. Predominantly a locally exploitable flaw, it requires the attacker to load a kernel module—typically requiring root or privileged access—to supply a malformed FF‑A driver with a NULL id_table and trigger the crash. Once the kernel is updated with the null‑check, the issue is mitigated.