The Linux kernel’s idpf driver contains a flaw where the read_dev_clk_lock spinlock is initialized after the PTP auxiliary worker is scheduled. Because the worker may acquire the lock before it is properly initialized, the code executes lock operations on an uninitialized object, generating a lockdep non‑static key warning and potentially causing undefined kernel behavior, including crashes or corruption. This weakness is recorded as CWE‑666 (Uninitialized Data) and CWE‑909 (Improper Synchronization).

All Linux kernels that ship the idpf driver without the commit that moves the spin_lock_init() call before ptp_schedule_worker() are affected. The CVE’s CPE entries list the Linux kernel generically and specifically identify versions 7.1 release candidate 1, 2, and 3. Therefore, any kernel version prior to 7.1 rc3 that does not contain the patch, as well as the 7.1 rc1 through rc3 release candidates lacking the reordering, are vulnerable.

The flaw carries a CVSS score of 9.8, reflecting critical severity. The EPSS score is reported as less than 1 %, indicating a low likelihood of exploitation in the wild. The CVE is not listed in the CISA KEV catalog. Based on the description, exploitation would likely require local or privileged access to trigger the PTP auxiliary worker before the lock is initialized; the description does not reveal a publicly available exploit. In any case, the high severity and kernel instability risk warrant prompt remediation.