The vulnerability is a race condition that occurs during early boot when an allocation made in hard‑interrupt context attempts to acquire a lock that the debugobject allocation routine also needs, causing a deadlock. This flaw is a race condition (CWE-667) with incorrect lock ordering (CWE-833). The result is a denial of service that stalls kernel initialization, but it does not expose or alter any data.

Linux kernels compiled for the ARM64 architecture that include the PREEMPT_RT patch set and the debugobjects subsystem are affected. Versions of the kernel that do not include the recent commits adding a guard to forbid allocations in hard‑interrupt context are vulnerable. Embedded or real‑time deployments that rely on early‑boot debugobjects fall into this category.

The CVSS score of 5.5 indicates medium severity, and the EPSS score of less than 1% suggests a very low likelihood of active exploitation. The defect is limited to the boot phase and requires local or physical access to influence interrupt timing before the scheduler starts; remote attackers cannot trigger the condition. Because it does not compromise confidentiality or integrity, the practical risk is a boot‑time denial of service. The vulnerability is not listed in CISA KEV, indicating no known active exploitation in the wild.