The tpm_crb driver had no test for the ACPI companion object during probe; if the driver is bound to a device that has no ACPI companion because device_match_driver_override forced the match, the driver dereferences a NULL pointer, causing a kernel panic that forces the operating system to reboot. This flaw is a classic null-pointer dereference and directly erodes system availability.

All Linux kernel builds that contain the tpm_crb driver and have not applied the patch referenced by the kernel commit, including standard distribution kernels and custom source builds that include this driver. Users of any Linux distribution that has not yet rolled the latest stable kernel (or patched the kernel manually) are affected.

Certified exploit metrics are currently unavailable; EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog. The flaw can be triggered by using the device_match_driver_override API to force the tpm_crb driver onto a device that has no ACPI companion. Based on the description, it is inferred that the API is intended for privileged users; a user with root-level access could thus cause the driver to dereference a NULL pointer, resulting in a kernel panic and system reboot. While no public exploit is known, the possibility of a local privileged attacker inducing an OS crash represents a high risk for environments where root access is possible. The CVSS score of 5.5 indicates a moderate severity.