The vulnerability is a NULL pointer dereference that occurs when debug_register_static() fails to clean up properly. The remaining uninitialized address fields are later used by debug_info_copy() during a copy operation, either via an area’s view file or a debug_dump() request. The dereference causes a crash, resulting in a denial of service for the affected system.

Linux kernel on the s390 architecture is affected. The exact kernel version is not listed in the CVE data; any kernel release that includes the s390/debug NULL pointer dereference patch is considered safe.

The CVSS score is 4.1, and the EPSS score is < 1%, so the precise exploitation likelihood cannot be quantified. Based on the description, the attack vector would require successful triggering of debug_register_static() failure and later access to a debug_dump() or view file, likely necessitating local or privileged user access. The flaw leads only to a crash and does not directly grant code execution or privilege escalation. The risk is therefore aligned with a moderate denial of service scenario on the affected systems.