In the Linux kernel the EDAC/mc subsystem contains a flaw where, upon a failed allocation inside edac_mc_alloc(), the error path executes before device initialization. The device’s release function is called on an uninitialized structure, leading to a kernel fault and system crash. This constitutes a denial of service that forces the machine to reboot or become unusable. The weakness is identified as CWE‑476 (null pointer dereference) and CWE‑824 (improper handling of uninitialized data).

All Linux kernel builds that include the pre‑fix EDAC/mc implementation are vulnerable. The issue applies to any distribution or custom kernel that still has the uninitialized device release path. Users of newer kernels that contain the corrected order are not affected.

The CVSS score of 5.5 indicates a moderate risk. EPSS score is less than 1%, indicating a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to require the kernel to encounter a hardware failure or explicitly trigger a bad allocation in the EDAC subsystem, which most users would not be able to induce remotely. Therefore, exploitation likelihood is low, but the impact is a denial of service if triggered.