The flaw is a race condition in the Linux kernel’s power management runtime code that allows a dangling parent device pointer to be dereferenced after the parent has been freed, resulting in a use‑after‑free error. This can cause a kernel BUG, a panic and potential loss of system availability. Based on the description, it is inferred that a local attacker might be able to trigger the condition to gain elevated privileges, though this has not been confirmed. The weakness is identified as a classic use‑after‑free race and is listed as CWE-364 and CWE-362.

The vulnerability affects the Linux kernel across all distributions that ship with the affected pm_runtime_work() implementation. No specific version range was supplied in the advisory, but the issue existed before the patch commit was integrated into the mainline kernel. System administrators should verify whether their current kernel revision contains the fix.

The CVSS score of 4.7 reflects moderate severity, while the EPSS score of less than 1 % indicates a low probability of widespread exploitation. The flaw is not yet listed in the CISA KEV catalog. The likely attack vector is local, requiring the attacker to manipulate device removal or to cause a race by performing privileged operations, such as inserting or removing hot‑plug devices. Because the flaw leads to a kernel panic, it could be used for denial‑of‑service; it is inferred that privilege escalation could be possible if an attacker successfully triggers the kernel BUG, but this has not been definitively documented.