The vulnerability is a race condition in the regmap subsystem's hwspinlock irqsave routine. When the address of &map->spinlock_flags is directly passed to hwspin_lock_timeout_irqsave, multiple contexts can overwrite the shared flags variable, corrupting the state of the current lock owner. This can result in incorrect behavior or data corruption and is categorized as a race condition (CWE‑362).

The affected product is the Linux kernel, including all versions prior to the fix. The CPE list identifies at least kernel 6.19 release candidates (rc1 through rc6) as impacted, and the notation suggests all earlier stable kernel releases are likewise vulnerable.

The CVSS score of 4.7 indicates moderate severity, and the EPSS score of less than 1% denotes a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would likely require concurrent execution contexts—such as multiple threads or interrupt handlers—that contend for the same regmap instance, making a local or privileged kernel context the most probable attack vector.