The Linux kernel’s mmio trace logging functions can dereference a NULL pointer when the global mmio_trace_array is uninitialized or has been disabled. When mmio_trace_rw() or mmio_trace_mapping() is executed under those conditions, the code attempts to access tr->array_buffer.buffer, which causes a kernel panic. This crash results in a system-wide denial of service, potentially requiring a reboot but does not grant an attacker code execution or privilege escalation.

The affected product is the Linux kernel. The vulnerability appears wherever the mmio tracing infrastructure is enabled and the mmio_trace_array global variable is NULL before it is initialized. All kernel configurations that enable mmio tracing without proper initialization of mmio_trace_array are susceptible. No specific kernel version is mentioned, so the issue could exist on any release that has the mmio tracing code enabled without the NULL check.

The CVSS score of 5.5 classifies the flaw as medium severity, while the EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting it has not been widely exploited. A local attacker would need a way to trigger the affected trace functions while mmio_trace_array remains NULL, such as by interacting with kernel trace interfaces or by enabling the tracing feature in a privileged context. When those prerequisites are met, the attacker can force a kernel crash, causing a denial of service. Remote exploitation is not supported by the current description.