A NULL pointer dereference occurs in the Linux kernel's ACPI NFIT subsystem when a firmware notification is received for a NFIT device that has no NFIT table present. The kernel installs a notification handler before confirming the table’s existence; if the table is missing, a NULL descriptor is used, and the handler dereferences it, causing a kernel panic. The patch added a NULL check to prevent this fault. The only impact reported is a denial‑of‑service condition via a kernel crash; no privilege escalation or confidential data exposure is indicated.

Any Linux kernel that contains the NFIT driver prior to the commit that added the null check is vulnerable. The affected code path resides in the ACPI NFIT subsystem; no specific distribution or kernel version list is provided, but any pre‑patch kernel that can accept ACPI NFIT notifications from firmware is at risk.

The CVSS score of 5.5 reflects a moderate severity. The EPSS score of less than 1% indicates that the likelihood of exploitation is low. The vulnerability is not included in the CISA KEV catalog. Exploitation would require firmware capable of emitting an NFIT_NOTIFY_UC_MEMORY_ERROR notification when the NFIT table is absent, or a privilege level that can trigger such a notification. As such, the risk is primarily a local denial‑of‑service threat with a low probability of attack.