The Linux kernel’s host1x bus device initialization routine fails to validate the client->ops pointer before dereferencing it during error teardown paths. When client->ops is NULL, the lack of a guard leads to a null pointer dereference that can crash the kernel, resulting in a system-wide denial of service. No evidence of direct privilege escalation or code execution is cited in the description.

All Linux kernel builds that include the host1x bus driver and lack the null‑check patch are impacted. Specific version numbers are not listed in the advisory, so any kernel version released before the commit that introduces the safeguard may be vulnerable.

Because the flaw only manifests in error paths, an attacker would need to trigger the device initialization failure while client->ops is NULL, inferring a local kernel exploitation scenario. The EPSS score of <1% indicates a very low probability of exploitation, and the CVSS score of 4.1 reflects moderate severity. The vulnerability is not listed in the CISA KEV catalog, so there is no known widespread exploitation. The risk is primarily an availability loss, resulting in a denial of service until the patch is applied.