The vulnerability arises from using a sleeping, RT‑maintained spinlock (spin_lock_irqsave) inside the pch_irq_type callback while the context is non‑sleepable and interrupts are disabled; on PREEMPT_RT kernels this leads the kernel to detect an invalid wait context and trigger a BUG, which can cause a panic or system reboot. The flaw does not provide direct code execution but can be leveraged to crash the system, resulting in a denial of service. The flaw is a misuse of concurrency primitives, specifically using a lock that can sleep where only a non‑sleepable lock should be used.

The issue exists in the Linux kernel’s GPIO subsystem for PCH devices before the fix was merged (commit 16da33c and related changes). Any kernel version that does not contain this commit or the equivalent raw_spinlock_t patch is potentially affected, regardless of distribution or patch level; the CVE description does not enumerate specific releases, so all earlier kernels may be vulnerable.

The CVSS score is 5.5, the EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is local or privileged; an attacker with the ability to inject a kernel module or manipulate IRQ settings could trigger the buggy lock usage and cause a crash. Because the exploit requires privileged code and is not directly exploitable from user space, the overall risk is moderate, relying on the attacker’s ability to invoke built‑in IRQ type changes.