Linux Kernel EUVD-2026-35147

Exploitation requires a local session with at least low-privilege credentials (PR:L per CVSS vector). The target system must have ADMV1013 microwave upconverter hardware physically present and the admv1013 kernel module loaded - systems without this hardware or with the module blacklisted are entirely unaffected. The crash is triggered during the driver's device initialization path specifically when device_property_read_string() fails, meaning the fault can manifest on initial probe at boot or on hotplug of the device. The attack is constrained to local denial of service only: no remote vector exists (AV:L confirmed), and there is no confidentiality or integrity impact (C:N/I:N per CVSS). Exploitation is limited by the niche hardware requirement, meaning the realistic affected population is confined to embedded, RF/signal-processing, and telecommunications systems integrating the ADMV1013 IC.

The CVSS 3.1 score of 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H is well-calibrated: the attack is strictly local, requires only low privileges, has no scope change, and the sole impact is availability - a kernel panic. EPSS at 0.02% in the 5th percentile confirms negligible exploitation interest from the threat actor community, consistent with the hardware-specific attack surface. The vulnerability is not listed in CISA KEV and no public exploit or POC has been identified. Real-world risk is further bounded by the requirement for physical ADMV1013 hardware, which is a niche RF/microwave component not present in standard server, desktop, or cloud environments. Despite AC:L indicating the crash is reliably reproducible once conditions are met, the compounding prerequisites - local access plus specialized hardware - make this a low operational priority for the vast majority of organizations. For embedded, telecommunications, or signal-processing environments where ADMV1013 hardware is deployed, this warrants prompt patching due to the reliable local DoS path.

A local user with standard low-privilege credentials on a Linux system that has an ADMV1013 microwave upconverter physically attached initiates or waits for driver initialization. During probe, device_property_read_string() returns an error and leaves str uninitialized; the subsequent strcmp() call dereferences the garbage pointer, causing a kernel NULL pointer dereference oops that panics the system and forces a reboot. No public exploit or POC has been identified at time of analysis, but the crash path is straightforward and reproducible on affected hardware.