An attacker could trigger a use-after-free violation by causing device_add() to fail during the asynchronous initialization of a non-volatile memory device. The flaw arises because the parent device reference is released before the child device is fully initialized, leaving a dangling pointer that can be dereferenced. This denial-of-service vector undermines the stability and correctness of the kernel, potentially leading to kernel panics or loss of service for systems relying on NVDIMM devices.

The vulnerability applies to the Linux kernel itself. All installations where the kernel includes the nvdimm/bus subsystem and is susceptible to asynchronous device registration would be at risk. No specific kernel version range is provided in the data, so a careful review of release notes is needed to confirm exposure.

The CVSS score of 4.7 places the issue in the medium severity range. Exploitation seems plausible only if an attacker can influence the creation of a non-volatile memory device whose addition fails, which suggests a local or privileged attack surface rather than a remote one. With an EPSS score of less than 1% and no listing in CISA’s KEV catalog, it is unlikely to be widely exploited at this time, but the inherent use-after-free flaw warrants prompt remediation.