In the Linux kernel, the null bus dereference in of_pci_range_parser_one() leads to a kernel crash when a device tree node contains ranges or dma-ranges but lacks a local #address-cells value. The dereference occurs during range iterator processing, causing the system to become unstable and unavailable. The failure is scoped to kernel space, resulting in denial of service.

All Linux kernel builds prior to the inclusion of commit 88752b811f72aa7a16de6dad4b25031d7308673e are vulnerable. No specific version ranges are provided, so any distribution kernel that has not applied this patch may be affected.

The CVSS score of 5.5 indicates moderate severity while the EPSS score is below 1%, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require a local attacker with the ability to modify the device tree or supply a custom kernel image, making the attack vector internal. If successful, the crash can interrupt services, resulting in denial of service.