The ixp4xx crypto driver builds a linked list of buffer descriptors for scatterlists through the function chainup_buffers. When dma_pool_alloc fails during this construction, the code sets a buffer pointer to NULL and later dereferences it unconditionally, triggering a null‑pointer dereference. This flaw leads to a kernel crash. Additionally, if the failure occurs after part of the descriptor chain has already been allocated and DMA‑mapped, the partially constructed chain is not released, exacerbating the instability. The weakness is a classic null‑pointer dereference, catalogued as CWE‑476.

The flaw exists in any Linux kernel that includes the ixp4xx crypto driver before the patch was applied. All distributions shipping such kernels with this driver compiled are potentially affected. No specific version numbers are listed in the advisory, so the safest assumption is that any kernel prior to the patch commit is vulnerable.

The CVSS score is 5.5 and the EPSS score is < 1%, indicating a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The known effect is a kernel crash, which is a high‑severity outcome. Based on the description, the likely attack vector is local; an attacker or system component that can force a DMA allocation failure while the ixp4xx driver is active could trigger the crash. No public exploit is documented, but the presence of an unhandled null dereference indicates a moderate to high exploitation complexity.