The vulnerability arises when the PCI endpoint driver creates sub‑groups asynchronously using a delayed work handler. If the driver directory is removed before the work executes, the handler dereferences a NULL pointer, causing a kernel crash. The crash manifests as a fault in configfs_register_group and a resulting kernel panic. This leads to a denial of service by bringing the affected system down to a non‑functional state. The weakness is a classic Defective Null Pointer Dereference (CWE‑476).

All versions of the Linux kernel that have not yet incorporated the fix are affected. The precise kernel release numbers are not specified in the advisory, so any kernel prior to the inclusion of configfs_add_default_group() is considered vulnerable.

The CVSS score of 5.5 indicates a moderate severity, and an EPSS score of less than 1% shows a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local: an attacker or a process with write access to configfs can repeatedly create and remove directories under /sys/kernel/config/pci_ep/functions without requiring privileged escalation, triggering the crash. Exploitation requires only the ability to execute the faulty work, which is present in the kernel’s configuration.