The defect occurs in the UFS host controller code where the rpmbs list is left uninitialized when the rpmb probe fails. On device teardown the kernel dereferences this NULL pointer, causing a kernel panic and system reboot. This loss of availability is a local denial of service caused by a flaw in the hardware abstraction layer of the UFS driver.

Kernel versions containing the UFS core driver before the committed fix are affected. This encompasses all Linux distributions using a kernel that has not yet merged the changes from the cited Git commits. Since the vendor list includes only Linux:Linux, any Linux system with a pre‑patch UFS host controller implementation is potentially vulnerable.

With a CVSS score of 5.5 the vulnerability is classified as moderate severity. The EPSS score of < 1% indicates a very low probability of exploitation, and it is not listed in CISA’s KEV catalog. The likely attack vector is local (inferred from the requirement to monitor or unload the driver). An attacker would need to induce a rpmb probe failure or have local access to trigger the crash (inferred). The kernel panic forces a system reboot, resulting in a local denial of service but the attack surface remains limited.