The vulnerability is a race condition in the Linux kernel’s device model. On calls to dev_has_sync_state(), the dev->driver pointer is read twice without protection by the device_lock(); one read is for a NULL test, the second dereferences the driver structure’s sync_state field. If a concurrent device unbind clears dev->driver while the function is executing, the kernel may dereference a stale or freed pointer, leading to a kernel crash. This can bring the entire operating system down, causing a denial‑of‑service.

All Linux kernel implementations released before the commit that changes dev_has_sync_state() to use READ_ONCE() and the corresponding WRITE_ONCE() in device_set_driver() are affected. This includes every distribution kernel version that predates the patch. No specific version range is listed in the CVE data, so a vulnerability assessment should assume that any unpatched kernel is at risk.

A CVSS score of 7.8 is assigned, and the EPSS score is <1%, indicating a very low probability of exploitation in general. The flaw can be triggered by an attacker with the ability to initiate a race between normal device usage and a device unbind operation, which typically requires local access or device control. Based on the description, it is inferred that the attack vector is local. While the potential for exploitation is high enough to cause a system crash, there is no evidence of remote exploitation or privilege escalation. Consequently, the risk level is moderate to high for environments that allow unbind operations from untrusted contexts. Because the vulnerability is not listed in the CISA KEV catalog, no known wild exploits have been reported.