In the Linux kernel’s Media Subsystem, the Mediatek mt8365‑AFE PCM device contains a subtle bug: the mt8365_afe_suspend() routine allocates a buffer with devm_kcalloc() but never verifies that the allocation succeeded before dereferencing the resulting pointer. If the allocation fails, the kernel performs a null pointer dereference when accessing afe->reg_back_up[i], causing a kernel panic or crash. This failure is not a remote code execution vector; it merely disrupts the operating system, leading to a denial of service that can affect the entire machine. The weakness is a classic NULL Pointer Dereference (CWE‑476).

The fault resides in the ASoC driver for Mediatek MT8365, part of the Linux kernel’s audio subsystem. All kernel builds that include the mt8365‑AFE PCM driver before the patch are affected. The specific kernel versions are not enumerated in the advisory, so any system running a kernel that compiles this driver is potentially impacted. The vendor is the Linux Kernel project, product Linux Kernel.

The advisory does not list an EPSS score; its exploit probability is unknown but the kernel crash is a high‑impact event. The vulnerability is not listed in CISA KEV, suggesting no known active exploitation. The attack can only succeed when an attacker can trigger a suspend operation on the device, which typically requires local or elevated privileges. Consequently, the risk is moderate: privileged users can cause a denial of service by forcing a suspend, but widespread remote exploitation is unlikely.