The ath12k wireless driver in the Linux kernel contains a flaw where null pointer dereferences occur during the destruction of internal hash tables. The destroy functions are invoked unconditionally during driver removal, but the tables are only allocated after later stages of initialization. If the driver never fully starts or initialization fails, the pointers remain NULL, and the subsequent call to rhashtable_destroy triggers a crash in irq_work_sync. The kernel crash leads to a system-wide denial of service, requiring a reboot, without providing remote code execution or privilege escalation.

All Linux distributions that ship the ath12k driver within the kernel are affected. The vulnerability exists in any kernel version prior to the patch that introduces NULL checks in the destroy routines for the ath12k_link_sta and ath12k_dp_link_peer hash tables, regardless of distribution or specific kernel revision.

The CVSS score of 4.1 indicates low severity. The EPSS score of <1% reflects a very low probability of exploitation, and the issue is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires local access to trigger driver removal or a scenario where the device fails to initialize fully, making it difficult for an attacker to reliably reach the crash state. Consequently, the overall risk remains low but mitigatable by ensuring the system runs a patched kernel.