A null pointer dereference occurs in the Linux kernel’s DRM XE driver during devcoredump cleanup. When a snapshot has never been fully populated, the ss->gt pointer may be NULL and the driver calls xe_guc_capture_put_matched_nodes() without a check, causing a kernel fault. The resulting kernel panic leads to an immediate loss of system availability, which is the classic denial‑of‑service impact. The weakness involved is a NULL pointer dereference (CWE‑476).

The flaw affects the Linux kernel across all vendors that ship an unpatched kernel with the DRM XE driver. Any kernel build that lacks the commit adding the guards in xe_devcoredump_snapshot_free() and xe_devcoredump_free() remains vulnerable; the associated CPE indicates all Linux kernel variants.

The incident is not currently listed in the CISA KEV catalog and the EPSS score is < 1%, indicating a very low probability of exploitation. The CVSS score of 5.5 reflects a moderate severity that mainly affects availability. Because the vulnerability is triggered by internal kernel activity related to Xe devcoredump cleanup, it is a local‑privilege or kernel‑level vulnerability. An attacker with the ability to influence the devcoredump cleanup sequence (for example, through privileged GPU usage or local code execution that force‑triggers cleanup) could induce the null dereference, causing a crash and a denial of service. The risk is significant for systems that rely on the affected kernel without mitigation.