The vulnerability originates in the Linux kernel media driver for i2c Alvium devices. During the initialization of controls, the function alvium_ctrl_init creates several controls and immediately dereferences the returned pointers without validating them. If a control allocation fails, the returned pointer is NULL, and the code attempts to write flags to it, which results in a NULL pointer dereference. This can cause the kernel to crash, leading to a denial of service. The flaw does not provide a direct code execution path, but a kernel panic can be leveraged by an attacker with sufficient privileges to destabilize the system.

All Linux kernels that contain the unpatched alvium media driver. The specific affected versions are not listed in the available data, so any kernel incorporating the vulnerable commit prior to the fix should be considered at risk. The vulnerability affects vendors providing the Linux kernel under the generic Linux:Linux entry.

The CVSS score is not provided, and exposure probability (EPSS) is unavailable, so the exploitation risk is inferred from the nature of the flaw. A NULL pointer dereference in kernel space is a high‑severity issue, but without evidence of a usable privilege escalation or remote exploitation path, the likelihood of exploitation remains uncertain. The vulnerability is not listed in the CISA KEV catalog, indicating it has yet to be observed in the wild. An attacker would need local or privileged access to trigger the flaw, typically via manipulating the media driver or inserting malicious firmware.