An invalid pointer dereference in the DRM Panthor driver can cause a kernel crash when the driver encounters an error pointer from the heaps subsystem during out‑of‑memory handling. The flaw triggers a panic that brings the entire system down, providing only a denial‑of‑service effect and compromising availability, not confidentiality or integrity. It is a classic null‑pointer dereference (CWE‑476).

The vulnerability exists in any Linux kernel that includes the unpatched drm/panthor driver, regardless of distribution. All kernels that compile this driver from the mainline source repository are potentially affected until the patch is applied.

The CVSS score of 5.5 indicates moderate severity, and the EPSS <1% indicates a very low probability of exploitation in the wild. The flaw resides in kernel space; an attacker would need local access to the DRM subsystem or sufficient privileges to create DRM contexts that trigger the out‑of‑memory path. This attack vector is inferred, as the CVE description does not specify an externally exploitable entry. A successful attempt would result in a system halt rather than attacker foothold. The vulnerability is not listed in the CISA KEV catalog.