A use‑after‑free flaw exists in the Linux kernel’s NVDIMM bus subsystem during asynchronous initialization. When device_add() fails in nd_async_device_register(), the reference count of the parent device can be dropped to zero before the code later accesses the parent pointer, resulting in a dangling pointer dereference. This memory corruption can cause a kernel crash or, if an attacker can manipulate the failure, may enable arbitrary code execution with kernel privileges. The weakness is a classic use‑after‑free and is listed as CWE‑416. No CVSS score is provided in the data, but the potential impact on kernel integrity and confidentiality is high.

All Linux kernel releases that include the NVDIMM bus subsystem but lack the patch introduced by commit b6eae0f61db2. In practice, this means any kernel version before the commit that added the parent reference handling during asynchronous initialization. Users should verify whether their distribution’s kernel contains this commit or a later equivalent patch.

The exploitability of the vulnerability is constrained to environments where the malicious party can trigger an asynchronous initialization failure of an NVDIMM device, typically requiring local system access or the ability to influence device add operations. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. Nevertheless, the kernel memory corruption nature warrants immediate attention, as the flaw can lead to unrestricted kernel access if exploited successfully.