The flaw is in the Linux power_supply subsystem, specifically the sbs‑battery driver. An improper ordering between a devm_ IRQ request and a devm_ power_supply handle registration creates a race condition. When the driver is removed or during probe, an IRQ can fire after the power_supply handle has been freed or before it is fully registered. The interrupt handler then calls power_supply_changed() with a dangling or uninitialized pointer, causing the kernel to crash or silently corrupt memory.

The vulnerability exists in any Linux kernel that includes the sbs‑battery power_supply driver and has not yet applied the fix identified by commit 14d4dee5d8fb361bfff275832087254beab66d72. The affected products are generic Linux kernels; no specific versions are enumerated, so all distributions shipping impacted kernel code are susceptible.

Exploitation requires an interrupt to fire during driver removal or during probe. The likely attack vector is a device‑initiated interrupt that occurs while the driver is being removed or the power_supply handle is not yet registered; this could be triggered by manipulating power events or hardware resets. The advisory does not provide a concrete exploitation path, so the precise attack vector remains unspecified. The EPSS score of < 1% indicates a very low likelihood of exploitation in the wild, and it is not listed in the CISA KEV catalog. A successful trigger could destabilize the system.