The vulnerability involves a NULL pointer dereference in the NFP driver during a resource lookup. When the driver allocates a CPP mutex handle and the allocation fails, it still reports success and later attempts to lock a null mutex, leading to a kernel panic. This results in a denial of service by crashing the system. The weakness corresponds to CWE‑476, null pointer dereference.

All installations of the Linux kernel that include the NFP driver and contain the vulnerable code before the applied commit. The vendor information lists only Linux:Linux, and no specific version ranges are provided, so any kernel version with the NFP module prior to the patch is potentially affected.

The bug is a local kernel flaw; an attacker would need to trigger the NFP resource lookup, which typically requires privileged context or interaction with user‑space tools that bind to the driver. Based on the description, it is inferred that the attack would need a process with sufficient rights to invoke the driver and cause the faulty allocation, resulting in a kernel crash. The CVSS score of 5.9 indicates moderate severity, and the EPSS score is < 1%, suggesting a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would immediately cause a denial of service, but no publicly known exploitation method exists, giving the risk a moderate but significant level for environments that rely on the NFP driver.