The vulnerability is a use‑after‑free error within the Linux kernel’s power reset subsystem, specifically in the linkstation_poweroff_init function. The code releases a node reference before fully using it. Based on the description, this could lead to memory corruption, which may potentially allow arbitrary code execution, system crashes, or denial‑of‑service, although the CVE entry does not explicitly state these outcomes.

The Linux kernel is affected. All kernel builds that do not incorporate the commit that moves of_node_put after of_match_node are vulnerable. No specific kernel release numbers are given.

The CVSS score of 7.8 indicates a medium to high severity risk. The EPSS score of less than 1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in CISA KEV. Based on the description, the bug resides in kernel‑space code; exploitation would require local or kernel‑level access to the linkstation device, making a remote attack vector unlikely without additional foothold.