The vulnerability in the Linux kernel CXL driver can cause a null pointer dereference when an auto‑assembly region contains a NULL hole in its target array. During automatic discovery the driver mistakenly assumes the first p->nr_targets entries are valid and may dereference a NULL endpoint decoder pointer, triggering a general protection fault and an Oops. This results in a kernel crash, interrupting system availability and potentially exposing memory contents during the fault.

All Linux kernel configurations that load the CXL driver. Any system that enables or uses CXL auto‑assembly regions is affected. The issue manifests when endpoints are removed or detached, leaving NULL entries in the target array.

Based on the description, it is inferred that the fault typically occurs during normal operation of the CXL driver, so the attack vector is local code execution through legitimate kernel operations involving CXL endpoints. The CVSS score of 5.5 indicates a moderate severity. The EPSS score indicates an exploitation probability of less than 1% (approximately 0.00172). The vulnerability is not listed in CISA's KEV catalog. The flaw leads to a kernel crash, interrupting system availability and potentially exposing memory contents; there is a low risk of privilege escalation if the fault occurs during normal device operation.