A failure in the IPI initialization path causes the global IPI array to be freed while the system continues to configure IPI support. A subsequent dereference of the freed memory results in a use‑after‑free, which can lead to arbitrary code execution or system crash in kernel mode. The flaw stems from missing error propagation between the init and probe functions, allowing the system to proceed with an invalid data structure.

Linux kernel implementations running on PowerPC platforms, including PSeries and pnv families. The vulnerability is present in any kernel build where the XIVE IPI subsystem is compiled and active. No specific patch level ranges are provided, so all current releases that include the unpatched implementation are susceptible.

The CVSS score of 7.4 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation. Exploitation requires reaching the error path during system initialization, and based on the description, it is inferred that this would require privileged or local access. Attackers would need to trigger the failed IPI allocation, for example during boot or via a specially crafted environment that forces the allocation routine to fail.