A null pointer dereference occurs in the Linux kernel power sequencing routine when a partially initialized unit is released without initializing its list field. This flaw can cause the kernel to crash via an unconditional list deletion, leading to a system reboot or hang. The vulnerability does not allow arbitrary code execution but results in a denial of service by destabilizing the operating system.

All affected Linux kernel versions are impacted until the fix that initializes the unit->list field in pwrseq_unit_new() is deployed. The vendor is Linux; the product is the Linux kernel. No specific version range is provided, so any kernel lacking the patch is considered vulnerable.

Based on the description, it is inferred that the attack vector involves interaction with the power sequencing subsystem, which is typically only reachable with kernel privileges. Since the flaw entails a NULL-pointer dereference leading to an unconditional list deletion, it triggers a kernel crash and results in a denial of service. The CVE does not provide a path for arbitrary code execution or privilege escalation, and no public exploitation is reported. The CVSS score is 4.1, indicating moderate severity, the EPSS score is < 1%, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The risk mainly stems from environments where power sequencing operations can be performed, possibly causing the kernel to reboot or hang, which could impair availability.