The vulnerability is a null pointer dereference in the Linux kernel’s MT7530 driver. When an MT7531 or MT7621 device is unbound, the driver calls regulator_disable() on pointers that were never allocated, causing a kernel panic. This results in a denial of service by crashing the system and is an example of the CWE‑476 weakness.

All Linux kernel builds that include the MT7531 or MT7621 drivers are affected. The flaw exists in the mt7530 subsystem used on platforms that incorporate these switch or Ethernet controller chips. No specific kernel versions are listed, so any kernel containing the unpatched driver logic is at risk.

Based on the description, the attack vector is local; any user with the ability to unload kernel modules or trigger a sysfs unbind operation can exercise the null dereference. The CVSS score of 4.4 indicates a low‑to‑moderate overall risk, while an EPSS score of less than 1% suggests that real‑world exploitation is unlikely at the moment. The vulnerability is not currently in the CISA KEV catalog. If an attacker can repeatedly exploit the flaw, each kernel crash results in a denial of service for the host. However, the low exploitation probability and the need for root privileges limit practical impact.