The vulnerability originates from improper instruction cache invalidation on remote OpenRISC cores when static branch keys are enabled or disabled. The prior implementation, copied from arm64, did not account for OpenRISC’s cache semantics, which allowed stale static key code to remain cached on sibling CPUs. If these stale instructions are later executed, the kernel may perform unintended operations or crash, leading to incorrect code execution or a denial‑of‑service condition.

This flaw impacts Linux kernels running on OpenRISC hardware. The fix is contained in commit 3fac46068fe4cea22ed373432b9173a915e8e60d and any subsequent releases. Users should verify whether their current kernel incorporates this change.

The CVSS score of 7.8 indicates a high severity vulnerability, while the EPSS score of <1% points to a very low exploitation probability. The flaw is not listed in the CISA KEV catalog, suggesting it is not known to be actively exploited. Based on the description, it is inferred that exploitation would likely require local or administrative access to trigger static_branch_enable changes; an attacker could cause stale code execution by manipulating static keys, resulting in incorrect behavior or a service outage.