The vulnerability occurs in the Linux kernel’s PCI endpoint code where the parameters in the unlink functions are swapped. When an unlink operation is performed on a PCI endpoint via configfs, the wrong argument order causes the kernel to misinterpret data and crash, resulting in a kernel fault and service interruption. The crash can lead to a full system reboot or loss of service for all users of that machine, representing a denial‑of‑service condition for local users who can access configfs. No remote exploitation path is described, so the impact is limited to local privileged or unprivileged access to the configfs interface. No exploits are currently known in the wild.

Affected systems are all Linux kernel installations that include the pci_{primary/secondary}_epc_epf_unlink() functions, which is every kernel that is not yet patched to the latest stable release. The CVE references kernel commit logs that show the fix was merged into the mainline. Users running recent kernels that incorporate these commits are unaffected; older kernels remain vulnerable.

The CVSS score is not disclosed, and EPSS is not available, so specific exploitation probability is unknown. However, the kernel crash indicates a high impact if the vulnerability is triggered. Because the flaw is triggered by a configfs unlink command, the primary attack vector is local and requires write access to the PCI endpoint’s configfs directory. The lack of a KEV listing suggests no publicly known, active exploits, but the presence of a critical crash warrants caution and prompt patching.