A race condition in the Linux kernel’s CXL driver allows a null‑pointer dereference during the creation of NVDIMM objects. When the NVDIMM bus is not yet registered, the code attempts to attach a new NVDIMM device to a missing parent, causing a kernel crash that halts the entire system. This flaw is a classic data‑consistency issue identified as CWE‑820.

All Linux kernel builds that compile the CXL and NVDIMM modules are affected, including the cxl_acpi, cxl_pmem, and libnvdimm drivers. The patch was applied in commit 5b230da, so any kernel released before that commit contains the flaw if it includes the affected modules. No precise version range is supplied, so every kernel build that loads these drivers prior to the patch remains vulnerable.

The CVSS score of 5.5 indicates medium severity, and the EPSS probability is below one percent, suggesting a low likelihood of active exploitation. The vulnerability is not listed in KEV, and there is no remote code execution path. Exploitation would require local access to arrange the loading order of kernel modules (cxl_acpi and cxl_pmem) to trigger the race, resulting in a crash rather than privilege escalation. The likely attack vector is a local privilege‑seeking process that can control module loading.