The CVE relates to the Rockchip PCI driver in the Linux kernel. When a root bus is stopped and removed concurrently with a rescan or hotplug operation, the kernel fails to hold the pci_rescan_remove_lock. This race can cause memory that has already been freed to be accessed, resulting in a use-after-free or a system crash, matching the identified CWE-413 weakness.

Linux kernel systems that ship the Rockchip PCI module and have not incorporated the commit that adds pci_rescan_remove_lock are affected. It is inferred that any kernel version prior to that commit is vulnerable, as no other fixes are documented. The flaw applies to distributions that include this driver in their shipped kernel.

The CVSS score of 5.5 and an EPSS score of < 1% indicate moderate severity and a very low likelihood of exploitation. The attack requires a user with privileges capable of manipulating PCI devices, so the attack vector is inferred to be local. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation in the wild to date. An attacker who can trigger the race may cause a denial-of-service.