These days null pointer dereferences can only directly be leveraged as denial-of-service conditions, as the zero page is always protected against being allocated. There are cases where the dereferenced pointer is not null, but does point to deallocated memory (e.g. UAF in a JIT), and these can generally be leveraged to gain LPE or RCE in certain cases - the latter mostly being applicable to JavaScript engine vulnerabilities.

That said, triggering a null deref can often have secondary effects outside the scope of DoS, e.g. producing a stack trace or core dump that leaks sensitive data in a way that an unprivileged user can access it.