The reported defect is a race condition in the Linux kernel's device model. The function dev_has_sync_state() reads the dev->driver pointer twice without holding the required device_lock(), once only to check for NULL and again to access the driver's sync_state member. While callers may hold device_links_write_lock, this lock does not protect against a concurrent device unbind that clears dev->driver via device_unbind_cleanup(). As a result, an attacker who can trigger a race may have the kernel dereference a stale or freed driver pointer, causing a crash or, in the worst case, an exploitable memory corruption. The immediate consequence is a kernel fault that can bring down the operating system, leading to a denial‑of‑service.

All Linux kernel implementations are affected until the kernel includes the commit that changes dev_has_sync_state() to read dev->driver exactly once with READ_ONCE() and pairs it with the WRITE_ONCE() used in device_set_driver(). The bug is present in every kernel release that predates that fix, regardless of distribution or vendor. There are no version filters provided in the CVE data.

The CVSS score is not supplied in the CVE record, and the EPSS score is unavailable. The vulnerability is not listed in the CISA KEV catalog. Although the flaw can cause a system crash, no evidence in the description indicates it allows remote code execution or lateral privilege escalation. The most likely exploitation scenario is a local privilege holder or an attacker with some level of device access triggering a device unbind while an application employs device links. Therefore, the risk profile is moderate to high for systems that allow unbind operations from untrusted contexts. The lack of a known exploit in the wild further reduces immediate threat, but the potential for a disruptive failure warrants prompt mitigation.