In the Linux kernel, the power sequencing subsystem had a NULL-pointer dereference flaw in pwrseq_device_register(). If dev_set_name() fails before the pwrseq->targets list is initialized, the error path is taken and the uninitialized list is later dereferenced by pwrseq_release(), causing a kernel crash. This produces a denial of service through a system crash without allowing data disclosure or arbitrary code execution.

All Linux kernel builds that include the power sequencing driver before the commit that moves the dev_set_name() call are impacted. No particular kernel versions are enumerated; the issue exists in every configuration containing the driver until the referenced patch is applied.

The vulnerability requires ability to trigger pwrseq_device_register() or pwrseq_release(), which typically occurs during driver load or shutdown. The likely attack vector is local with privileged access to load or interact with the power sequencing driver; this is inferred from the fact that the flaw is only exercised when the driver is active. Because the defect only leads to a kernel crash, the impact is a denial of service rather than exploitation of data or code. The EPSS score is < 1% and the issue is not listed in CISA KEV, and with a CVSS score of 4.1, the vulnerability presents a moderate risk for systems that rely on the driver.