The vulnerability lies in the Media Subsystem of the Linux kernel, where the Mediatek mt8365‑AFE PCM driver’s suspend routine allocates a buffer with devm_kcalloc() but does not verify the allocation succeeded before using the returned pointer. If the allocation fails, the driver dereferences a null pointer when accessing afe->reg_back_up[i], which can cause a kernel panic and a system crash. This defect is a classic NULL Pointer Dereference (CWE‑476). The failure does not provide execution of arbitrary code but can crash the operating system, resulting in a denial of service for the host.

The defect resides in the ASoC driver for Mediatek MT8365, part of the Linux kernel’s audio subsystem. Any Linux kernel build that includes the mt8365‑AFE PCM driver before the patch is potentially affected. The specific kernel versions are not enumerated in the advisory, so any system running a kernel that compiles this driver is at risk. The vendor is the Linux Kernel project, product Linux Kernel.

The CVSS score of 5.5 indicates a medium severity, and the EPSS score of less than 1% indicates a very low exploitation probability. The kernel crash is a high‑impact event, which would lead to a denial of service if an attacker can trigger a suspend operation on the device. The vulnerability is not listed in CISA KEV, suggesting no known active exploitation. An attacker would need local or elevated privileges to induce the suspend sequence, so widespread remote exploitation is unlikely, but privileged users could bring the system down by forcing a suspend. The likely attack vector is local execution or privilege escalation that can trigger suspend operations; this inference is based on the description that the exploit requires a suspend action.