The Linux kernel’s idpf network driver fails to initialize the read_dev_clk_lock spinlock before the PTP auxiliary worker is scheduled. When the worker later attempts to acquire this lock, it is operating on an uninitialized resource, triggering a lockdep "non‑static key" warning. Such use of an uninitialized lock can result in undefined behavior, potentially causing a kernel crash, corruption, or loss of service. The weakness is categorized as CWE‑909.

All Linux kernels that include the idpf driver without the commit that moves the spin_lock_init() call before ptp_schedule_worker() are affected. The vulnerability exists in any kernel version where the driver has not yet applied the specified change; no specific version numbers are provided, so any kernel without the reordering of the lock initialization is vulnerable.

This flaw carries a CVSS score of 9.8, indicating critical severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The CVE is not listed in CISA’s KEV catalog. Exploitation would likely require local or elevated privileges to trigger the PTP worker or manipulate the driver state, and the description does not provide a proven exploit pathway. Nonetheless, the high severity combined with the potential for kernel instability warrants prompt remediation.