The CVE describes a defect in the Intel i915 graphics driver of the Linux kernel where, when a memory allocation with GFP_ATOMIC fails and leaves a node pointer set to NULL, the driver erroneously returns a reference derived from the NULL pointer. This results in a NULL pointer dereference when the caller later uses the reference, potentially causing a kernel crash. Since the operation occurs in kernel space, an attacker could leverage this flaw to gain local privilege escalation or a denial‑of‑service, and the weakness is a missing null‑pointer check (CWE‑476). Based on the description, it is inferred that an attacker could trigger the fault by inducing memory pressure on the GPU during atomic allocation, for example by repeatedly creating and destroying GPU contexts.

Both canonical Linux mainline kernels (as indicated by the CPE cpe:2.3:o:linux:linux_kernel) that ship the i915 driver before the inclusion of commit 6029bc06 are affected. Distributions that have not upgraded past that point, including many actively maintained releases, remain susceptible. The bug is tied to the driver code that handles active_instance allocation, so any system relying on the upstream kernel or a vendor kernel that has not applied the fix is at risk.

The CVSS score is not provided and no EPSS value is available, so the likelihood of exploitation in the wild is currently uncertain. The vulnerability was discovered through AI‑assisted static analysis and confirmed by Intel Product Security; no public exploit has been reported and it is not listed in the CISA KEV catalog. Nonetheless, because null‑pointer dereferences in kernel code are typically high‑severity and can lead to privilege escalation, the risk should be treated with caution and remediation applied as soon as possible.