In the Linux kernel, the function that locks two regulators uses a deadlock‑aware mutex lock. When contention occurs, the mutex function returns -EDEADLK to signal that the caller should release any lock it already holds and retry in the correct order. The regulator code, however, mistakenly checks for the value -EDEADLOCK. On processors where EDEADLK and EDEADLOCK are distinct, such as MIPS, the comparison fails. The code therefore skips the expected back‑off logic, triggers a warning, and returns with only one of the two regulators locked. This improper error handling can leave a regulator in an inconsistent state, potentially leading to power‑management failures or device malfunction. The weakness is a result of an incorrect comparison of error return codes, categorised as CWE‑1025. The missing logic does not directly provide a path for arbitrary code execution, but it can compromise the reliability of power‑management subsystems that depend on multi‑regulator coordination. The CVSS score of 7.8 indicates high severity, yet the EPSS score is below 1 %. The vulnerability is not listed in the CISA KEV catalogue. Exploitation would require the ability to trigger concurrent regulator acquisition on a MIPS system – a capability normally limited to local, privileged code. These inferred attack requirements are not directly stated in the advisory. The overall threat is therefore moderate, with low likelihood of exploitation in most environments but potentially significant availability impact on vulnerable MIPS platforms when the regulator core is enabled.

The defect resides in the Linux kernel code for regulator_lock_two, which is invoked when the regulator core subsystem is compiled into the kernel. The bug manifests on MIPS architectures because the error codes differ; on SPARC and PowerPC the kernel usually does not use the regulator core, so they are effectively not impacted. Therefore the affected platforms are Linux kernel (regulator core enabled) running on MIPS, with no specific version information provided.

The CVSS score of 7.8 reflects significant potential impact on system availability. The EPSS score of < 1 % indicates that current exploit activity is believed to be very low. The vulnerability is not listed in the CISA KEV catalogue, so there is no known widespread or targeted exploitation campaign associated with it. The likely attack vector is local privilege escalation on a MIPS system where a malicious user or process can trigger the regulator_lock_two function. Since the regulator core is not typically built on SPARC or PowerPC, those architectures are effectively immune. In the absence of a direct code‑execution path, the risk is primarily the failure of power‑management operations, potentially causing device malfunction or service interruption.