In Linux kernel versions preceding the applied patch, the regulator subsystem can incorrectly combine multiple fault events into a single bitmask before handing them to the critical protection handler. When distinct events such as under‑voltage and over‑current occur before the batching worker runs, the resulting bitmask does not match any explicit case in the switch statement of regulator_handle_critical(). As a result, the fault reason is left NULL and the critical hardware protection routine is bypassed entirely. This failure to detect and react to hardware faults could allow a system to continue operating in a degraded or unsafe state, potentially leading to hardware damage or systemic instability.

All Linux kernel distributions that do not include the commit that corrects the event batching logic are affected. This includes every kernel build prior to the introduction of the fix identified by commit 754bd2b4a084. Users of standard, unmodified Linux kernels without supplemental patches are thus vulnerable until the kernel is upgraded to a version containing the corrected regulator event handling.

The vulnerability carries a CVSS score of 7.1, with an EPSS score of less than 1%, indicating a low probability of exploitation. The likely attack vector, inferred from the fact that the fault bypass occurs within the kernel’s regulator subsystem, would involve privileged or internal actions related to hardware events; remote exploitation is unlikely. The risk remains significant because hardware protection could be bypassed, potentially leading to hardware damage or system instability. Since the vulnerability is not listed in the CISA KEV catalog, it is not known to be widely exploited, but the criticality of the hardware safety function justifies prompt remediation.