The flaw in the Linux kernel involves a misordering of reference counting and context setting for Intel uncore boxes during CPU online and offline events. When a CPU comes online, the box is given a reference before the context is reset, leaving the device uninitialized on the first CPU in a die. Conversely, on a CPU going offline the unreference occurs after the context change, preventing proper teardown. This off‑by‑one reference count can cause the uncore device to be destroyed while still in use, leading to undefined behaviour and potentially a kernel crash.

All Linux kernel builds that support the perf/x86/intel/uncore subsystem and contain the pre‑fix code path are affected. Versions released before the commit that swaps the call order in uncore_event_cpu_online() and uncore_event_cpu_offline() carry the vulnerability.

The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating a low probability of exploitation. No public exploits are known. Because the flaw requires influencing CPU online/offline transitions, it is likely limited to privileged or local contexts, making large‑scale remote exploitation difficult. The primary impact is a denial of service through kernel instability, but an attacker with sufficient privilege could trigger a crash to disrupt critical services.