A null dereference can occur in the optee_ffa_lend_protmem function of the Linux kernel when memory pressure is high and the allocated pointer is not validated. This flaw, a classic null pointer dereference, can cause the kernel to crash, resulting in a denial of service on the affected system.

All Linux kernel installations that include the OP-TEE firmware interface (optee_ffa) are potentially impacted. No specific kernel versions are listed, so the vulnerability may affect any kernel build that has not applied the patch adding the missing NULL check.

The exploitability of this flaw requires an attacker to be able to cause high memory pressure or otherwise trigger the allocation path that fails. Because the failure occurs inside privileged kernel code, a local attacker with kernel or root privileges can force a crash. The EPSS score is not available, and it is not listed in the CISA KEV catalog, suggesting that no widespread exploitation is currently reported. However, the straightforward nature of the payload means that once the conditions are met, denial of service can be achieved with minimal effort.