The flaw is a race condition in the Linux kernel’s power management runtime code that allows a dangling parent device pointer to be dereferenced after the parent has been freed, resulting in a use‑after‑free error. This can cause a kernel BUG, a panic and potential loss of system availability or local privilege escalation if an attacker can trigger the condition. The weakness is identified as a classic use‑after‑free race and is listed as CWE-364.

The vulnerability affects the Linux kernel across all distributions that ship with the affected pm_runtime_work() implementation. No specific version range was supplied in the advisory, but the issue existed before the patch commit was integrated into the mainline kernel. System administrators should verify whether their current kernel kernel revision contains the fix.

The CVSS score of 7.0 reflects high severity, while the EPSS score of less than 1 % indicates a low probability of widespread exploitation. The flaw is not yet listed in the CISA KEV catalog. The likely attack vector is local, requiring the attacker to manipulate device removal or to cause a race by performing privileged operations, such as inserting or removing hot‑plug devices. Because the flaw leads to a kernel panic, it could be used for denial‑of‑service or privilege escalation depending on the circumstances.