The EDAC/igen6 driver in the Linux kernel contains a flaw where device objects lack a release() function. When the igen6_edac module is unloaded, the kernel attempts to call the missing function, generating a call trace warning and potentially dereferencing a null pointer. This defect can cause a kernel crash, leading to a denial‑of‑service condition for the affected system.

All Linux kernel builds that include the EDAC/igen6 driver without the upstream patch are vulnerable. The kernel version or distribution is unspecified, so any kernel released before the fix that ships the EDAC/igen6 module could be affected. The issue manifests only when the module is loaded and then removed.

The CVSS score of 5.5 indicates medium severity. Exploitation requires a privileged attacker able to unload the module (root or direct rmmod access). With a EPSS score below 1%, the likelihood of exploitation in the wild is low, and the vulnerability is not listed in the CISA KEV catalog, meaning no known public exploits exist. If an attacker can unload the driver, the attempt to call a nonexistent release() function could trigger a kernel crash, resulting in a denial‑of‑service for the entire system.