The flaw originates in the Linux kernel’s Firewire OHCI driver, where the cleanup routine ar_context_release() dereferences a NULL pointer during probe error handling. This causes a kernel crash (general‑protection fault with KASAN reporting a null‑ptr‑deref), resulting in a Denial‑of‑Service that may reboot or halt the affected host. The weakness is a classic NULL‑pointer dereference that releases critical kernel resources.

The issue affects all Linux kernel installations that include the Firewire OHCI driver, which is part of the default Firewire stack. Any kernel build that compiles or includes the firewire/ohci.c module when a device fails to initialize early during probe can trigger the crash. Specific affected release versions are not listed, so any kernel containing the unpatched driver is at risk.

There is no CVSS score supplied and the EPSS is not available, but the presence of an uninitialized pointer in a kernel cleanup routine is a high‑severity weakness. Since it is triggered during device probe, the attack vector is local and requires the kernel to load the OHCI driver, thus requiring at least system boot or privileged device insertion context. Because the bug is not tied to an external driver input, exploitation is unlikely from a network standpoint but can be leveraged by anyone able to influence device initialization, such as by inserting a faulty Firewire device or triggering a probe failure. The vulnerability is not listed in the CISA KEV catalog.