The vulnerability arises from the Linux kernel's dibs device subsystem, where the lock used to protect dibs device data is not initialized when the device registers an interrupt handler. Because dibs_dev_alloc() allocates the device before the lock is set, an interrupt can occur before dibs_dev_add() initializes the lock. The interrupt handler, ism_handle_irq(), unconditionally acquires the uninitialized lock. This race can provoke undefined behavior, potentially leading to denial of service by crashing the kernel.

Affected systems run the Linux kernel with the dibs device driver, which could be the ISM driver used for integrated silicon management. The CVE notes only a generic Linux kernel, with no specific version guidance, so any kernel containing the uninitialized lock code prior to the patch is at risk. The affected product is the Linux kernel; version information is not supplied.

No CVSS score or EPSS data is published, and the vulnerability is not listed in CISA KEV. Because the flaw hinges on low-level interrupt handling and requires a device capable of generating the specific GID events, the likelihood of exploitation in the wild is uncertain. However, an attacker with local or higher privileges who can trigger the relevant interrupts might cause a denial of service. The fix simply moves lock initialization into dibs_dev_alloc(), eliminating the race.