The Linux kernel vulnerability identified as CVE-2025-71307 involves a NULL pointer dereference in the drm/panthor driver during the panthor_fw_unplug() function. The root cause is the code waiting for the MCU to halt, which is unsafe if the firmware is not loaded or initialized, potentially causing a NULL pointer dereference. The fix removes the MCU halt and wait steps, opting instead to disable the MCU directly on unplug, which is safer given the MCU's variable states.

This vulnerability can cause a denial of service by crashing the kernel due to a NULL pointer dereference during device unplug operations. There is no impact on confidentiality or integrity reported. The CVSS vector indicates local attack complexity, low privileges required, no user interaction, and an impact limited to availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described patch removes unsafe MCU halt and wait procedures during panthor_fw_unplug() to prevent the NULL pointer dereference. Until an official fix is confirmed, avoid scenarios that trigger panthor_fw_unplug() if possible.