The flaw occurs in the media subsystem of the Linux kernel; the function media_pad_remote_pad_unique() returns a valid pointer or an ERR_PTR on error but the return value was assigned to isp->remote_src without error checking before dereferencing. If an error is returned, the dereference triggers a kernel fault, which can lead to a crash that takes the system offline, i.e., a denial‑of‑service scenario. This weakness is a consequence of dereferencing an erroneous pointer and does not immediately expose code execution or data disclosure, but an unpatched system can be made non‑functional by a local actor who is able to manipulate the media device streaming behaviour.

Linux kernel deployments that include the media framework and, more specifically, the Mali‑c55 driver. The exact kernel versions are not enumerated in the data, but the fix is present in the updated kernel source referenced in the advisory, so any kernel containing earlier versions of the media subsystem is vulnerable.

The CVSS score of 5.5 indicates a moderate severity. The flaw is a local exploit; an attacker with the ability to configure or trigger a media stream on a device using the Mali‑c55 driver can cause a kernel panic. EPSS is <1%, indicating a low probability of exploitation, and the vulnerability is not in KEV, so no known widespread exploitation yet. Nonetheless, the failure can bring the system down, so it should be treated as a local denial‑of‑service risk.