In the Linux kernel, regulator operations such as get, set, and list voltage for PMBus devices accessed shared registers and data without proper mutex protection, leading to race conditions. The patch adds a mutex lock but must avoid a deadlock caused by nested calls in the notifier chain. The vulnerability can result in inconsistent regulator state, potential hardware malfunction, and a possible denial‑of‑service scenario for devices relying on accurate voltage control.

All Linux kernel variants that implement PMBus regulator drivers before the patch, affecting any hardware using PMBus power management hardware accessed by the kernel. The exact kernel versions are not listed but the vulnerability applies to any kernel containing the pre‑patch code.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating a lower profile of exploitation. The CVSS score is not published, but the lack of remote exploitation paths and requirement for kernel context suggest a moderate threat level. The likely attack vector would involve locally privileged code able to trigger concurrent regulator access, such as a malicious kernel module or a vulnerable user‑space interface that drives regulator functions. No known exploit has been reported.