Null pointer dereference occurs in the dw_dp_remove() function of the Rockchip DRM driver when it attempts to access driver data via platform_get_drvdata() after a failed component bind. This unguarded access causes a kernel crash, resulting in a denial of service. The vulnerability is a classic null pointer dereference.

All Linux kernel builds that incorporate the Rockchip DRM driver are affected. The advisory does not specify a version range, so any system running a kernel that still contains the unpatched dw_dp_remove() routine could be vulnerable. The issue is confined to the Rockchip DRM subsystem.

The CVSS score is 5.5, indicating a moderate severity. The EPSS score is reported as less than 1% (approximately 0.00166), indicating a low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. The flaw would be exercised when the driver is removed after a failed bind, which may happen during device hot‑plug events or when the system reboots – this is inferred from the description. Exploiting this requires the ability to trigger the removal, which typically requires local or elevated privilege; this attack vector is inferred. While no public exploit exists, the kernel panic that results is a severe denial‑of‑service risk.