The flaw occurs in the media subsystem of the Linux kernel; the function media_pad_remote_pad_unique() returns a valid pointer or an ERR_PTR on error but the return value was assigned to isp->remote_src without error checking before dereferencing. If an error is returned, the dereference triggers a kernel fault, which can lead to a crash that takes the system offline, i.e., a denial‑of‑service scenario. This weakness is a consequence of dereferencing an erroneous pointer and does not immediately expose code execution or data disclosure, but an unpatched system can be made non‑functional by a local actor who is able to manipulate the media device streaming behaviour.

Linux kernel deployments that include the media framework and, more specifically, the Mali‑c55 driver. The exact kernel versions are not enumerated in the data, but the fix is present in the updated kernel source referenced in the advisory, so any kernel containing earlier versions of the media subsystem is vulnerable.

The CVSS score is not disclosed, but the presence of a NULL pointer dereference in the kernel indicates a high severity. The exploit is local; an attacker with the ability to configure or trigger a media stream on a device using the Mali‑c55 driver can cause a kernel panic. EPSS is unavailable, and the vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation yet. Nonetheless, because the failure results in a system reboot or halt, it should be treated as a high‑risk local denial‑of‑service vulnerability.