A flaw in the Linux kernel allows a use-after-free violation during asynchronous initialization of a non-volatile memory device. When device_add() fails, the parent device reference is dropped too early, leaving a dangling pointer that can be dereferenced by the kernel. This leads to kernel instability or crashes. The issue is classified as a high severity problem with a CVSS score of 7.8.

The vulnerability affects all Linux kernel installations that include the nvdimm/bus subsystem and use asynchronous device registration. While no specific kernel version range is listed in the data, any kernel incorporating the nvdimm/bus path prior to the applied fix is potentially exposed.

The CVSS score of 7.8 indicates a high severity level. Exploitation would require influencing the creation of an NVDIMM device whose addition fails, meaning the attack surface is likely local or privileged. With an EPSS score of less than 1% and no listing in the CISA KEV catalog, widespread exploitation is presently unlikely, but the use-after-free nature warrants prompt remediation.