The vulnerability is a NULL pointer dereference within the Linux kernel’s s390/debug module. When debug_set_level() is called with an unvalidated value returned by debug_register(), the missing null‑id check allows the function to dereference a null pointer, causing a kernel panic. This crash results in a denial of service by forcing the system into an unrecoverable state.

All Linux kernel builds that run on s390 architectures and contain the unpatched commit a2cec6863709 are affected. The flaw persists in any kernel version that incorporates that commit without the subsequent fix, and no specific version range is listed.

The crash is triggered by a call to debug_set_level(), so the vulnerability can only be exploited when an attacker has the ability to invoke the debug API, which normally requires local or privileged access. The vulnerability is not listed in the CISA KEV catalog, indicating no known public exploitation. The EPSS score is less than 1%, suggesting a very low probability of exploitation. Because the description does not mention remote attack vector, it is inferred that the vulnerability is primarily a local issue. The CVSS score of 5.5 indicates a moderate severity.