The Linux kernel flaw permits a race condition between PCI rescan or hotplug operations and the removal of a root bus. When a root bus is stopped and the pci_rescan_remove_lock lock is not held, the system may experience a use‑after‑free, potentially corrupting memory or causing a kernel crash. This vulnerability directly affects system stability and can lead to denial‑of‑service through unexpected restart or hang events.

All Linux kernels that lack the pci_rescan_remove_lock added for root bus removal are impacted. The advisory does not specify exact kernel version ranges, so any distribution running a kernel version prior to the patch containing this lock is at risk. The affected product is the Linux kernel itself, covering all vendor implementations.

Based on the description, it is inferred that exploitation would likely require local or privileged access to trigger the race condition, but the precise attack vector is not detailed. The CVSS score is 5.5, indicating moderate severity; the EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. The lack of publicly documented exploits suggests the exploitation complexity is moderate to high, and the potential impact is severe due to the possibility of a system crash or collapse of the PCI subsystem.