The vulnerability stems from a race condition in the Linux kernel’s MMC subsystem where bitfield read‑modify‑write operations on the host-claimed flag and retune control bits shared a single word. Concurrent updates in asynchronous contexts could overwrite unrelated bits, leading to false WARN_ON messages and potential state corruption of MMC hosts. This faulty synchronization could cause incorrect driver behavior or kernel instability if the bit mis‑written triggers erroneous logic.

The issue affects the Linux kernel’s MMC core module. Any installation of the kernel that includes the mmc subsystem is potentially impacted until the fixed commit is applied. Exact kernel releases are not specified in the data, so all kernel versions before the patch are considered vulnerable.

The CVSS score is 5.5, indicating moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploit at this time. The flaw involves concurrent access to shared bitfields in the MMC subsystem; exploitation would likely require local or privileged access to the kernel, possibly through a malicious MMC device driver.