A race condition in the Xilinx ZynqMP power driver causes work structures to be allocated after the driver registers their event callbacks. If a firmware-initiated suspend or subsystem restart event occurs between registration and allocation, the callback dereferences a NULL pointer in work_pending(), leading to a kernel panic. The vulnerability results in a denial of service that requires a system‑wide reboot to recover.

The flaw affects the Linux kernel’s Xilinx ZynqMP power driver. No specific kernel version range is listed in the advisory, so any kernel that contains the unpatched code is potentially impacted. Systems running this driver on ZynqMP platforms should verify whether they are on a fixed release.

The CVSS score is not provided and the EPSS score is unavailable, so the overall exploitation probability cannot be quantified. The vulnerability requires an attacker or a compromised firmware to trigger a suspend or restart event precisely at the race window; the exact attack vector (local, privileged, or remote) is not disclosed, making the likelihood of exploitation uncertain. The issue is not listed in CISA’s KEV catalog, suggesting no known active exploitation.