During the probe of the LPC32xx ADC driver in the Linux kernel, the interrupt handler is registered before its completion object is initialized. If the device generates an interrupt before the completion is set up, the handler calls complete() on an uninitialized structure. This causes the kernel’s address sanity checker to detect a wild memory access, leading to a kernel panic and a system crash. The flaw is a use‑of‑uninitialized-object vulnerability and manifests as a denial‑of‑service condition when the driver is loaded.

Any Linux kernel that contains the original lpc32xx ADC driver source located in drivers/iio/adc/lpc32xx_adc.c may be affected. Since the repository does not provide a specific version list, the defect could exist in any kernel release that has not yet reordered init_completion() to precede devm_request_irq(), particularly on systems using LPC32xx family hardware where the driver is enabled.

Exploitation requires an interrupt to fire during a very brief window while the driver is being probed. This is not a trivial attack and would normally need an adversary with control over hardware configuration or the ability to trigger interrupts at precise timing, i.e., local privilege or specific device access. The EPSS score is below 1%, and the vulnerability is not listed in CISA’s KEV catalog, indicating a low likelihood of widespread exploitation. The risk is therefore a localized denial‑of‑service via system crash rather than a widespread remote attack vector. However, the impact of a kernel panic is severe, so the issue should be remediated promptly.