A null pointer dereference occurs in the Cadence USBSS driver when the second PCI function is probed before the first function has finished initializing. The driver accesses driver data that has not yet been set, leading to a kernel panic. This failure stops the affected system from booting or operating normally, resulting in a denial of service. The flaw is a classic example of CWE‑476, where improper null pointer handling allows a program to crash when dereferencing a null pointer.

The vulnerability affects Linux kernels that include the Cadence USBSS driver for the two‑function PCI device. Any distribution or custom kernel version that packages this driver is potentially vulnerable. No specific vendor or kernel release was enumerated in the data, so all Linux kernels that ship the cdns3 driver should be treated as impacted.

The CVSS score is 4.1, indicating low severity, though a kernel panic still represents a significant denial of service on systems using the affected controller. The EPSS score is < 1%, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely local: an attacker with the ability to load the driver or interfere with its probing sequence could trigger the crash. If the system is compromised already, the crash can be leveraged for privilege escalation or denial of service. However, no remote exploitation has been documented.