In the Linux kernel, the psxpad_spi suspend routine fails to initialise its driver data, causing a null pointer dereference when the driver is suspended. This software defect is a classic null pointer dereference (CWE‑476) that can trigger a kernel oops and cause the entire system to crash or become unresponsive. The consequence is a denial of service, as the kernel reboot is required to restore normal operation.

The affected product is the Linux kernel's psxpad_spi driver. All deployments of the Linux kernel that contain this driver and have not yet applied the later patch are at risk. The fix was included in the kernel revision referenced by the commit list in the references. The impact is limited to systems where the psxpad_spi driver is used, such as devices that depend on the PlayStation controller interface over SPI.

EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is not specified, but the nature of the flaw suggests a high severity. The attack vector is inferred to be local; an attacker with the ability to trigger a device suspend—typically a privileged user or a root process—can invoke the bug. Since the pointer is dereferenced in the kernel, exploitation results in a crash, giving no direct escalation but providing a reliable denial of service channel. The lack of a public exploit indicates that this is a low to medium chance of exploitation unless an exploit is discovered.