During kernel initialization, the sti driver registers its shared IRQ before initializing its irq_lock. If an interrupt occurs between registration and lock initialization, the handler proceeds with an uninitialized lock, which can trigger a kernel panic or crash. The flaw does not directly expose confidentiality or integrity, but it can be leveraged to destabilize a system by causing repeated disruptions whenever the interrupt is triggered. This manifests as a local denial of service within the affected kernel instance.

The flaw is present in all Linux kernel releases up to the point where the commit that introduced the proper initialization order was merged. It affects any system using the Advanced System on Chip (ASoC) sti driver, regardless of distribution, as long as the kernel version predates the fix. Therefore, all Linux kernels that have not applied the patch via a distribution update are susceptible.

The CVSS score is 5.5; the EPSS score is less than 1%, so the quantitative severity and exploitation likelihood can now be measured. KEV data indicates that the vulnerability is not currently listed as a known exploited issue. The attack vector is likely local, requiring the attacker to trigger the race condition by generating interrupt activity after the driver registers but before the lock is initialized. An attacker with kernel-level privileges could potentially orchestrate repeated crashes, but remote exploitation without such privileges is unlikely. The overall risk is moderate, primarily due to the potential for service disruption and the difficulty of exploiting the race condition from outside the host.