The Linux kernel’s cpufreq subsystem creates a policy object and publishes its sysfs directory before initializing the policy’s read‑write semaphore. A user context that accesses the new sysfs attributes can trigger a callback that attempts to acquire the semaphore before it has been constructed, resulting in undefined behavior such as a kernel assertion failure or a crash. This manifests as a denial of service on the host system.

All unpatched Linux kernel releases that contain the sequence of commits where the semaphore is initialized after kobject publication are impacted. The problem existed in kernels preceding the commits 27c9b491, 2cee937f, 3e5d1bf4, and dc11263c. Any distribution kernel that has not yet incorporated these changes is vulnerable; no specific downstream vendor versions are enumerated in the advisory.

The CVSS score of 5.5 indicates a moderate risk level. The EPSS score is less than 1%, suggesting the likelihood of exploitation is very low. The vulnerability is not listed in CISA’s KEV catalog, and the attack vector is local, relying on access to the cpufreq sysfs interface. Because the flaw leads to a denial of service rather than privilege escalation, the overall threat is limited to availability impact for affected systems.