The Linux kernel MPAM subsystem contains a null‑pointer dereference that occurs when a component configuration is destroyed. The __destroy_component_cfg() function adds RIS mbwu_state objects to a garbage list, but some RISes lack a valid mbwu_state instance. Passing a NULL pointer to add_to_garbage() causes a kernel panic, resulting in a crash and a brief denial of service.

The flaw is present in all Linux kernel releases for ARM that support the MPAM (Memory Power Management) feature, regardless of distribution. Any kernel build containing the unpatched MPAM code before the referenced commit is vulnerable; there is no distinction by vendor in the advisory.

With a CVSS score of 4.1, the vulnerability is considered low severity. The EPSS score is less than 1 %, indicating a low probability of active exploitation, and the issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need local privileged access to invoke component configuration destruction in order to trigger the flaw, after which a kernel crash will occur. Because of the low exploitation probability and moderate severity, the overall risk is limited, but immediate patching is still recommended to eliminate the denial‑of‑service risk.