The vulnerability exists in the Linux kernel's hwmon acpi_power_meter driver, where its notify callback registers and unregisters hwmon devices while holding a lock that sysfs attribute callbacks also acquire. This overlap can lead to deadlocks between sysfs access and device removal. The resulting race condition can stall the kernel, causing service interruption or system hang. The fix removes the unregister from the lock and introduces a dedicated mutex to serialize concurrent notifications, preventing the deadlock and ensuring sysfs operations remain responsive.

The issue affects Linux kernel builds that include the acpi_power_meter driver prior to the applied patch. Affected builds include all 6.19 release candidates from rc1 through rc8 and other Linux kernel releases that have not yet incorporated the commits mentioned in the references. Any system running a kernel version older than the patched code is potentially susceptible.

The CVSS score of 5.5 classifies the vulnerability as medium severity. However, the EPSS score of less than 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves triggering ACPI power meter notifications or performing sysfs attribute access during device removal, which could be leveraged by a local or possibly remote attacker with capabilities to influence ACPI events. In practice, the risk is moderate to low, primarily affecting systems with exposed ACPI interfaces and lacking the patch.