The vulnerability occurs in the Linux Asynchronous Sound Architecture (ASoC) Xilinx formatter PCM driver. IRQ handlers are supplied a struct device pointer but the driver data normally retrieved by dev_get_drvdata() is not attached until the probe function finishes, after devm_request_irq() has already been called. If an interrupt is delivered between those points, the handler attempts to read device registers through a NULL pointer and the kernel crashes. This is a classic NULL pointer dereference in a critical kernel path, leading to a denial of service for the affected system.

All Linux kernel builds that include the Xilinx formatter PCM driver are affected, regardless of architecture. The bug manifests in the ASoC component of the kernel and is limited to machines that have Xilinx PCM hardware enabled during driver initialization.

The defect is exploitable by any process capable of triggering an interrupt while the driver is in its probe phase, which typically requires local privileged access or precise timing control. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, but the nature of the crash suggests a high impact if triggered. Because the flaw is a NULL pointer dereference inside the kernel, an attacker who can cause the interrupt will cause an immediate kernel panic, resulting in a loss of service. The lack of a publicly available exploit in the references suggests the exploitation effort is nontrivial, yet the severity remains high due to the critical nature of kernel crashes.