The stm32-adc driver in the Linux kernel performs a division on an ADC conversion result without first verifying that the value is non-zero. When an ADC conversion fails or returns zero, such as the Vrefint channel, the driver attempts to divide by this zero value, triggering a division-by-zero fault that causes the kernel to crash. This flaw corresponds to the classic divide-by-zero weakness listed as CWE-369.

All Linux kernel installations that incorporate the unpatched stm32-adc driver are affected; distributions that ship a kernel prior to the commit adding the zero-value check should be considered at risk. No specific kernel release numbers are identified in the advisory, so any build containing the vulnerable code path should be scanned.

The EPSS score of less than 1% indicates a very low probability of exploitation, and the vulnerability is not present in the CISA KEV catalog, suggesting no publicly known exploits. The CVSS score of 4.7 places the issue in the moderate severity range. The likely attack vector is inferred to be an attacker with the ability to trigger ADC conversions on the target system, either by physical interaction with the ADC hardware or via a software interface that causes failed conversions. Exploitation would require access to the driver’s conversion path, and the resulting kernel crash would deny service to the system.