The dwc_pcie driver in the Linux kernel does not handle the absence of RAS DES capability correctly. During initialization it reports success and leaves the rasdes_info structure unset. When the driver is torn down the routine dereferences this uninitialized pointer unconditionally, causing a kernel NULL pointer dereference that results in a crash and a complete loss of service.

All Linux kernel builds that include the dwc_pcie driver and have not yet incorporated the patch fixing the dereference are affected. The exact kernel versions are not listed, but any mainstream distribution shipping the standard kernel prior to the commit referenced in the advisory is vulnerable, unless the vendor has backported the change.

Based on the description, it is inferred that exploitation requires local privileged access because the dwc_pcie debugfs interface is normally accessible only to root. The EPSS score of < 1% indicates a very low probability that automated attacks will target this vulnerability, and it is not listed in CISA's KEV catalog, suggesting no widespread exploitation. The CVSS score of 5.5 indicates a moderate severity, reflecting the potential impact of a kernel crash. Nevertheless, the crash can disrupt critical services; therefore the risk warrants prompt kernel updates. The vulnerability does not require network exposure or remote code execution; it is limited to local systems with kernel access.