The vulnerability resides in the AMD node subsystem of the Linux kernel where exported functions amd_smn_read and amd_smn_write call an internal helper that accesses the global amd_roots pointer without ensuring it has been allocated. If amd_smn_init fails, amd_roots remains NULL while the functions are still reachable; a subsequent call dereferences the null pointer, causing a kernel fault that results in a system crash. This constitutes a null pointer dereference classified as CWE-476. The crash leads to denial of service affecting all users on the host.

All Linux kernel implementations for the x86 architecture that include the x86/amd_node module are potentially affected. The flaw manifests when amd_smn_init fails, leaving amd_roots NULL while exported functions remain available. Any kernel without the patch commit 0a4b61d9c2e4 or later can expose this vulnerability.

The CVSS score of 5.5 describes a medium severity primarily because the impact is a kernel crash. The EPSS score of < 1% indicates that widespread exploitation is unlikely. The flaw is not listed in CISA KEV. Based on the description, it is inferred that the attack vector is local, requiring an attacker to invoke the vulnerable exported functions after an initialization failure, which would typically need privilege or local access. Successful exploitation deterministically leads to a system crash, but no remote execution is provided.