A null dereference can occur in the Linux kernel when the optee_ffa_lend_protmem function is executed under high memory pressure and the allocated pointer is not validated. This flaw, a classic null pointer dereference, can cause the kernel to crash, resulting in a denial of service on the affected system.

All Linux kernel installations that include the OP-TEE firmware interface (optee_ffa) are potentially impacted. No specific kernel versions are listed, so the vulnerability may affect any kernel build that has not applied the patch adding the missing NULL check.

The likely attack vector is an attacker able to trigger memory pressure or force the allocation path to fail, as described in the advisory. Based on the description, it is inferred that such conditions might arise from local processes or system load, suggesting that a local attacker with the ability to influence memory usage could potentially exploit the flaw. The CVSS score of 5.5 indicates a medium severity. The EPSS score of <1% shows a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, implying no widespread exploitation is currently reported.