The bug arises in the Linux kernel’s ice driver after a change that added an internal temperature sensor to the HWMON interface. When a devlink reload sequence occurs and the driver is later removed, the driver’s cleanup routine is left dangling. This leaves an orphaned hwmon instance that points at freed memory. Subsequent system‑monitoring attempts to read this sysfs entry trigger a page fault, causing a call trace and ultimately a kernel panic. The crash manifests roughly every ten minutes if monitoring tools keep polling the stale sysfs attributes, resulting in a denial‑of‑service condition for the host. The defect does not provide remote code execution or privilege escalation; however, the system crash can be triggered by actions that manipulate the network device (devlink reload) or unload the module, which typically requires elevated privileges. The core weakness is a use‑after‑free flaw caused by improper cleanup symmetry between initialization and removal of the hwmon interface, leading to dangling pointers. It is inferred that the attack vector requires elevated privileges to perform devlink reload or module unload.

The issue affects Linux kernel builds that include the ice driver, specifically those that incorporate the commit adding hwmon support and prior to the fix that moves the cleanup routine to ice_deinit_features(). This includes kernel versions with the ice driver up to at least Linux 6.19 RC6, as well as any custom kernels that have not yet applied the patch.

The CVSS 5.5 score indicates a moderate severity. The EPSS score is below 1 %, suggesting a very low probability of exploitation in the wild. The vulnerability is not catalogued in the CISA KEV registry. It is inferred that the attack vector is local and requires privileged access to perform the devlink reload or unload operation. While the impact is limited to a denial‑of‑service condition, the kernel panic can cause significant downtime, especially on production systems that rely on persistent network connectivity.