The vulnerability is a null pointer dereference in the Linux kernel ISST driver, affecting the sst_inst[] array when loading a socket fails. If the null pointer is dereferenced, the kernel can crash, resulting in a loss of system availability and forcing a reboot. This weakness is identified as CWE‑476, a classic null‑pointer dereference scenario.

All Linux kernel implementations prior to the inclusion of the NULL check are affected. The affected module is the ISST driver in the platform/x86 subsystem. Any kernel that has not been updated to a version containing the 3de2776e9d7… commit (or later equivalent) remains vulnerable.

The CVSS score of 4.4 indicates a moderate severity. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting low exploitation likelihood and no known active use in the wild. Exploitation requires local or privileged access and the ability to cause a socket load failure, making it a local denial of service vector rather than a remote exploit.