The vulnerability originates in the Linux x86 MCE (Machine Check Exception) handling logic. A timer used for CMCI (Control‑modifying Control‑Room Information) detection is initialized after CMCI discovery, which leads to double‑initialization of the same timer object. This causes an assertion failure in the kernel and results in a crash, manifesting as a kernel panic and system disruption. The impact is therefore a denial of service, as a single injected CMCI error or a benign hardware fault can trigger the crash. The weakness is an improper initialization flaw.

Vendors: Linux kernel. All Linux kernel builds that include the x86 MCE code prior to the fix. The exact version range is not specified, but the failure occurs in unreleased 7.2.0-rc5 builds and any kernel that has not incorporated the commit that rearranges timer setup. System administrators should verify that their installed kernel includes the commit referenced in the provided kernel repository links.

This code path is exercised during normal system boot and operation when a CPU emits a CMCI event. An attacker could trigger a CMCI storm or similar condition to force the crash, especially if CMCI events are not normally emitted on the hardware. The CVSS score is not provided, but the local impact is high; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The vulnerability is likely exploitable in environments where hyper‑threading or virtualization introduces CMCI storms, but the required conditions make it less immediately exploitable compared to remote code execution flaws. Nonetheless, any system that could receive CMCI events from malicious firmware or a compromised guest is at risk of a kernel crash.