The vulnerability arises from an improper synchronization between the addition of dynamic operating performance points (OPPs) and their lookup. When dev_pm_opp_add_dynamic inserts a new OPP into the list before initializing its reference count, an overlapping lookup can access the partially constructed object, incrementing an uninitialized counter and causing corruption. If the corrupted counter leads to a premature free, the kernel may experience memory corruption. This flaw is an example of an internal race condition and potential double‑release behaviour.

The bug is present in every Linux kernel build that predates the inclusion of three specific commits (46696b0b…, bb75bd7d…, f5e1cc9a…), which adjust the order of initialization and insertion for OPPs. Systems running any kernel version that does not incorporate these patches—i.e., any build before the commit set—are vulnerable. Linux kernel is the affected product.

This vulnerability has a CVSS score of 7.8 and an EPSS of less than 1%, and it is not listed in the CISA KEV catalog. The low EPSS indicates a rare exploitation likelihood, but the high CVSS suggests significant potential damage if exploited. The likely attack vector is local or privileged access that can trigger concurrent OPP operations; this is inferred from the description. No documented exploits have been reported, but the internal nature of the flaw could lead to kernel instability if exploited.