A missing call to pm_runtime_disable when a virtual device is detached in the Linux kernel core genpd subsystem can leave runtime power management enabled for a device that no longer exists. This oversight may trigger a null pointer dereference during genpd_runtime_suspend or keep an unnecessary vote for a performance state, both of which can cause the kernel to crash. The impact is the loss of system stability and availability.

The flaw applies to all Linux kernel releases that contain the genpd_dev_pm_attach_by_id and genpd_dev_pm_detach functions without the disabling logic. In the absence of the corrective commit, any kernel that has not been updated will expose the behavior. No specific distribution is singled out; any Linux kernel build is potentially affected until the patch is applied.

The CVSS score of 5.5 indicates a moderate severity, and the EPSS score is not available, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, indicating that no public exploits have been reported to date. Because the bug involves kernel space code, an attacker would need local access or a way to trigger device attach/detach operations to exploit it. The potential consequence remains high only if the crash or performance state mismanagement is invoked.