The Linux kernel dwc_pcie driver fails to handle the case where a controller has no RAS DES capability. During initialization the code reports success and leaves the rasdes_info structure unset; the later deinitialization routine then dereferences this uninitialized pointer unconditionally, causing a kernel NULL pointer dereference. This results in a kernel crash that aborts the affected system, a classic denial‑of‑service scenario. The weakness is a classic NULL pointer dereference, identified as CWE‑476.

All Linux kernels that include the dwc_pcie driver without the fix are vulnerable. The commit that introduced the patch is listed in the reference logs, so any kernel version built from source prior to incorporating that commit – effectively all mainstream releases that have not yet applied the change – are affected. The issue applies to all distros that ship the default Linux kernel unless a vendor has backported the patch independently.

The only remediation path is to load the corrected kernel. The exploitation path requires local access to the debugfs interface for the dwc_pcie driver, which is typically restricted to privileged users; therefore the threat is limited to local privilege or root users. No EPSS score is available and the vulnerability is not listed in CISA KEV, indicating that widespread automated exploitation has not yet been observed. Nonetheless, the crash can interrupt critical services, so the risk warrants prompt kernel updates to avoid denial‑of‑service incidents.