In the Linux kernel, the GVE driver contains a missing implementation of the ptp adjfine function. When an attacker calls the ptp adjustment routine with a null pointer, the kernel dereferences the null pointer and crashes. The resulting kernel panic causes the system to halt, effectively denying service to all users. The vulnerability is a classic null pointer dereference (CWE‑476) and does not provide direct code execution, but it can be used to disrupt service on a system where the attacker has local or privileged access.

All Linux kernel versions that include the GVE driver and have not yet applied the fix. The specific vendors affected are Linux distributions that ship the stock kernel source, typically any Linux kernel before the commit that added the fix. The patch addresses the bug in the GVE driver; therefore any system using the GVE driver before the update is impacted.

The CVSS score of 5.5 indicates moderate severity, and the exploit prediction score (EPSS) is < 1%, suggesting low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation. The likely attack vector is local: an attacker with root or sudo privileges can run a testptp command to trigger the crash. An attacker without elevated privileges would need to acquire privilege escalation before reaching the necessary execution path. Given the local nature and lack of known exploits, the risk is considered moderate, but a patch is still required to prevent denial of service.