The defect occurs in the UFS host controller code where the rpmbs list is left uninitialized when the rpmb probe fails. On device teardown the kernel dereferences this NULL pointer, causing a panic and device reboot. The result is a local denial of service that can affect any process that triggers the unloading of the driver.

Kernel versions containing the UFS core driver before the committed fix are affected. This encompasses all Linux distributions using a kernel that has not yet merged the changes from the cited Git commits. Since the vendor list includes only Linux:Linux, any Linux system with a pre‑patch UFS host controller implementation is potentially vulnerable.

The EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, indicating a low probability of widespread exploitation. An attacker would need to induce a rpmb probe failure or have local access to trigger the crash. The kernel panic results in a system reboot, meaning a high‑impact local denial of service, though the attack surface remains limited.