This vulnerability occurs in the DRM Panthor firmware loading code within the Linux kernel. When a firmware section contains a zero‑byte range, the code creates no memory object and leaves its pointer null. Subsequent reload or unplug operations later dereference this pointer, causing a null pointer dereference that can crash the kernel and bring the system down. The impact is therefore a denial of service via kernel panic. The flaw is a classic null‑pointer misuse in kernel space.

The affected product is the Linux kernel for all distributions that include the DRM Panthor driver. No specific version information is listed in the advisory, so any kernel incorporating this code path prior to the fix may be vulnerable. Subsequent releases that incorporate the reported fix are not affected.

The vulnerability is exploitable when an attacker can supply or modify firmware used by the Panthor driver. While typical firmware loading requires privileged access, a local attacker who can install custom firmware may trigger the crash. The EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating a very low exploitation likelihood. The consequence is a crash rather than data exfiltration or code execution, but a kernel panic can still be severe in production environments. The CVSS score of 5.5 indicates medium severity. The likely attack vector is local with elevated privileges; if the kernel driver exposes firmware loading to unprivileged users, the risk could increase.