The flaw occurs when the Linux kernel’s uacce driver attempts to call the internal put_queue function without ensuring that the driver’s state has been properly transitioned to a safe release phase. This oversight can lead to a null pointer dereference of the ops structure during a concurrent poweroff operation on virtualized systems, causing the kernel to crash. The weakness is a classic null pointer dereference (CWE‑476).

Linux kernel versions 6.19 RC1 through RC6 are affected; any host running those kernels without the latest patch is at risk. The patch also applies to earlier 6.19 releases that share the same vulnerable code path, though the CPE list specifically lists only the release candidates.

The CVSS score of 5.5 indicates medium severity, and the EPSS score of less than 1 % suggests that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local privileged access: an attacker must be able to issue the UACCE_CMD_PUT_Q ioctl or otherwise trigger the put_queue function while a poweroff command is concurrently being executed, such as during a forced shutdown of a virtual machine that still has the accelerator device active. Successful exploitation would crash the kernel, resulting in a denial of service of the entire system.