A race condition exists in the Linux kernel’s pds_core component where auxiliary device add and delete operations are not correctly synchronized. The add path registers a new device without verifying that the slot is empty, resulting in the previous device leaking if a second add occurs concurrently. The del path checks the slot outside the critical lock, so two simultaneous deletes can both pass the check; the first clears the slot and the second subsequently dereferences a NULL pointer. This flaw can cause a kernel crash, leading to a denial of service, and may also allow sensitive kernel objects to leak through the mishandled add operation.

The vulnerability affects all Linux kernel distributions that have not yet incorporated the recent commits that resolve the race (commits on 646b58b543f3bb1641e9123b75ff7799fe7b42f1 through e194751fed50cf3452017b63f00142a0ab40c70). Vendor specific product names are identical to the kernel itself; no particular version is singled out by the advisory, implying the fix applies to any kernel containing the referenced commits.

The CVSS score of 4.1 indicates a low severity, but the flaw remains a race condition that can lead to a NULL pointer dereference (CWE‑476). Based on the description, it is inferred that an attacker could manipulate PF and VF interfaces to trigger concurrent add or delete operations. The EPSS score of 0.168% indicates a very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog; however, the potential for a local or remote attacker to trigger concurrent add or delete operations via timing still poses a significant risk, especially in systems where untrusted code can manipulate PF and VF interfaces.