The defect emerges when a firmware node object is created on the stack or with a non‑zeroed allocator and subsequently initialized via fwnode_init(). Because the secondary pointer is left uninitialized, later functions such as dev_to_swnode() may dereference it, leading to a memory read of garbage data that can corrupt kernel memory or trigger a kernel panic. This can result in a loss of service for the system or its components. The vulnerability is a use‑of‑uninitialized‑data flaw in core kernel code.

The flaw affects the Linux kernel, specifically the firmware node initialization routine. There is no publicly listed version range; any kernel that contains the buggy fwnode_init() implementation before the fix is susceptible.

The risk is moderate because, as indicated by the CVSS score of 5.5, the vulnerability holds medium severity. The kernel runs in privileged context, so an exploit would require code that calls fwnode_init() on a node allocated without zeroing memory, which can happen in many kernel drivers that create temporary software nodes. Although the EPSS score is below 1% and it is not listed in the CISA KEV catalog, the flaw can lead to a kernel crash or memory corruption when a user with sufficient access creates such nodes. No public exploit is known.