The vulnerability lies in the aspeed-g6-pwm-tacho driver of the Linux kernel. Inside aspeed_tach_val_to_rpm, a fan RPM value is computed by dividing a constant by the tachometer count, but the driver fails to validate that the count is non‑zero. When the hardware reports a tachometer value of zero, the division by zero triggers a kernel panic, leading to a complete denial of service for the host. This crash can be triggered by a hardware glitch or sensor fault, allowing an attacker to bring the system down.

All systems that run the Linux kernel with the aspeed-g6-pwm-tacho driver loaded are affected. The kernel driver is generally used on hardware featuring the Aspeed G6 chipset, but this relationship is inferred from the driver name; the CVE data itself lists only the Linux kernel vendor and no specific kernel versions.

The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, but the resulting kernel panic is rated with a CVSS score of 5.5, indicating medium‑severity impact. Because the flaw is triggered by a tachometer value that can be zero due to a hardware glitch, it can be exercised with access to the underlying hardware. Based on the description, it is inferred that the attacker may need local or privileged access to induce the crash, but once the crash occurs, the entire host becomes unavailable for service.