A NULL‑pointer dereference is triggered in the I²C core of the Linux kernel when an adapter registration fails and the release callback runs. The uninitialized completion structure leads to a kernel panic, terminating the system. The vulnerability does not provide a remote code execution surface beyond this crash and thus primarily results in a denial‑of‑service condition.

Linux kernel builds prior to the commit that fixes the issue are affected. All Linux kernel versions on Linux systems that have not adopted this particular patch are potentially vulnerable. No specific version range is documented in the advisory; any kernel where I²C adapter registration can fail may be impacted.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating limited evidence of public exploitation. The CVSS score is not specified, but a kernel crash implies a high severity impact. The attack vector is inferred to be local privilege or privilege escalation, since an attacker must be able to cause a failed I²C adapter registration; if the system allows external devices to influence I²C registration, a non‑privileged attacker could indirectly trigger the fault. No remote exploitation is explicitly described.