Linux Kernel EUVD-2026-86952

Exploitation is confined to systems whose kernel loads the msc313e watchdog driver - i.e. MStar/SigmaStar MSC313e-series ARM SoCs with CONFIG_MSC313E_WATCHDOG enabled; general-purpose Linux installs without this hardware/driver are unaffected. The specific trigger is a power-management suspend or resume event: msc313e_wdt_suspend()/msc313e_wdt_resume() call dev_get_drvdata(), which returns NULL because msc313e_wdt_probe() failed to set the platform device driver data. Limiting factors: attack vector is LOCAL (AV:L, no remote reach), it requires privileges (PR:L) sufficient to be on the device and to initiate or await a suspend/resume cycle, and impact is availability-only (a crash) - there is no information disclosure or code-execution path described.

This is a genuinely low-priority issue despite the 'MEDIUM' CVSS 5.5 label. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) describes a local, authenticated, availability-only defect - no confidentiality or integrity impact. EPSS agrees: 0.17% probability (5th percentile), indicating essentially no observed exploitation interest. It is NOT in CISA KEV, and no exploit or PoC is present in the input - the only references are the upstream fix commits on git.kernel.org. The vuln.today decision label is 'this_month' (routine patching), not act_now or emergency, which is consistent with the low-severity, low-EPSS, no-KEV signal set. Importantly, the impact is further constrained: the NULL dereference occurs inside the msc313e watchdog driver's suspend/resume PM callbacks, so it only matters on hardware that uses this specific driver and only during a power-management transition. The 'Denial Of Service' tag is accurate but the realistic blast radius is a local crash on a narrow class of embedded devices. No conflicting signals of note; all sources point the same direction (low real-world risk).

On a system running the MStar/SigmaStar MSC313e SoC watchdog driver, a local user or automated power-management event triggers a system suspend/resume cycle. Because the driver never set its platform driver data, the suspend/resume PM callbacks retrieve a NULL pointer via dev_get_drvdata() and dereference it, crashing the kernel (availability loss). No public exploit code is present in the input - only the upstream fix commits.