The vulnerability arises in the Mediatek DRM driver of the Linux kernel. The function platform_device_register_data can fail and return an error pointer. However, the code assigns this error pointer to ddp_comp[].dev without checking it, and then passes that pointer to component_match_add() and mtk_ddp_comp_init(). This leads to an invalid pointer dereference and a kernel panic, which results in a denial of service. Based on the description, it is inferred that the unchecked return value directly causes the crash.

The flaw affects all Linux kernel installations that include the Mediatek DRM driver and have not incorporated the commit adding the IS_ERR check. Because no specific release dates are supplied, any kernel build that contains the old implementation is potentially vulnerable, including distribution kernels that have not been updated with the patch.

The vulnerability can be exploited locally by an attacker with the ability to load or interact with the Mediatek DRM subsystem, forcing platform_device_register_data to fail and triggering the invalid pointer dereference. The CVSS score of 4.1 indicates a moderate impact, while the EPSS score of < 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The exploit would result in a kernel crash, denying service.