The PCA953X driver in the Linux kernel disables the regmap locking mechanism because the driver manages its own lock. When the function pca953x_irq_bus_sync_unlock() performs a regmap read or write, it does not acquire the i2c_lock that protects the bus. The race between concurrent kernel threads could therefore cause an incorrect direction or interrupt mask register to be read or written, leading to incorrect GPIO configuration. The resulting corruption can affect hardware operation or cause a denial of service for processes that rely on accurate GPIO states.

All Linux kernel builds that include the PCA953X GPIO driver and that have not incorporated the recent patch adding missing i2c_lock protection are potentially affected. The vulnerability applies to any distribution or custom kernel derived from the up‑stream source before the commit was applied; no vendor‑specific or version information was supplied. The impact therefore is broad within the Linux ecosystem.

The CVSS score of 7.8 indicates high severity, and the EPSS score of < 1% suggests a low likelihood of exploitation. The flaw requires concurrent kernel thread access and local or kernel privileges (inferred from the need to race on the kernel bus), making it a local concurrency issue rather than a remote code execution vulnerability. It is not listed in the CISA KEV catalog. An attacker with local access could potentially trigger the race and corrupt register state, causing unpredictable hardware behavior or denial of service. No public exploits have been reported.