The flaw in the Linux i3c driver permits an interrupt handler to acquire a lock before the lock is properly initialized. During probe, the driver requests the IRQ and unmasks the command interrupt before setting up the transfer queue state and the dynamic lock. A pending interrupt can therefore execute the transfer‑queue lock acquisition code before the lock structure has been constructed, which can lead to undefined kernel behaviour, including spinlock corruption, deadlock, or a kernel panic. This is a classic race condition mitigated by improper initialization and is represented by CWE‑909.

The vulnerability affects the Linux kernel's i3c master driver across all product is generally the standard Linux kernel distribution. No version range is listed in the input, so any kernel build prior to the patch that includes the described change may be affected.

The CVSS score of 8.4 indicates a high severity impact, and the EPSS score of < 1% and its absence from the KEV catalog provide additional context on the potential risk. The exploit would likely require an attacker with local or privileged access such as a malicious user who can trigger I3C commands. The vulnerability is not listed in CISA's KEV catalog.