A race condition in the Linux kernel gpiolib module can cause a kernel crash when two drivers concurrently call gpiochip_add_data_with_key. One driver may traverse the srcu‑protected list while another has just added its device, dereferencing an uninitialized gdev->srcu pointer. The result is a kernel panic, leading to a denial of service that compromises system stability. The flaw is a classic race condition (CWE‑362).

All Linux kernel releases that include the vulnerable gpiolib code, specifically the 6.19 release candidates 1 through 4 and earlier unsupported kernels. The fix is delivered in kernel patches that move the initialization of the gdev fields before adding the device to the list. Systems running any kernel version prior to the patch are affected.

The CVSS score is 4.7, indicating moderate severity. The EPSS score is less than 1 %, implying a low likelihood that this flaw will be exploited in the wild. The vulnerability is not listed in the CISA KEV catalog. It is inferred that an attacker would need local or root access to load a driver that triggers the race; it is also inferred that remote exploitation would require privileged interaction. The primary impact is service disruption through a kernel panic.