The Linux kernel vulnerability involves the cros_ec_typec driver in the Chrome OS platform where the mutex adata->lock was not initialized in the function cros_typec_register_thunderbolt(). This omission leads to a NULL pointer dereference when the mutex is acquired later, such as in cros_typec_altmode_work(). The issue was resolved by properly initializing the mutex in the registration function. The vulnerability affects Linux kernel versions before 7.0.0-28.28.1 and is tracked under Ubuntu kernels for multiple LTS and other releases.

The vulnerability can cause a denial of service (DoS) by triggering a NULL pointer dereference and subsequent crash when the uninitialized mutex is accessed. There is no impact on confidentiality or integrity. The attack vector requires local access with low privileges and no user interaction is needed. The scope is unchanged, meaning the impact is limited to the vulnerable component.

A fix is available in Linux kernel version 7.0.0-28.28.1 and later. Users should update to this version or newer to remediate the issue. Since this is a kernel-level vulnerability, applying the official kernel update from the vendor or distribution is the recommended mitigation. No additional workarounds or mitigations are indicated.