During device initialization the mtd_info structure must be linked to its parent. A missing link leads to a NULL pointer dereference that causes the MTD subsystem to fail. This crash prevents the kernel from successfully initializing memory technology device support, which can block the boot process or render the system unusable. The primary impact is a denial of service as the kernel cannot complete initialization and may halt or reboot.

The vulnerability affects the Linux kernel itself, as identified by the CPE for Linux. All Linux kernel builds that include the vmu-flash driver without the parent linkage are susceptible. The issue was identified in the kernel source, and all distributions shipping such a driver without the applied commit are impacted.

The CVSS score is not provided in the available data, and no EPSS value is available. The vulnerability is therefore classified as a local, operating‑system‑level fault that requires either physical or privileged access to influence device initialization during the boot sequence. Because the defect manifests only when a device lacks a parent link, its exploitation is limited to environments where malformed configuration or missing device relationships can be introduced. The vulnerability is not listed in the CISA KEV catalog.