In the Linux kernel, the adf4377 frequency driver registers a clock but only partially initializes the clk_init_data and clk_parent_data structures. Uninitialized members may contain garbage values that the clock framework later uses, leading to a kernel crash. The crash results in a denial‑of‑service, disrupting system operation until a reboot or reset.

The vulnerability resides in the Linux kernel’s adf4377 frequency device driver. It affects any kernel that includes this driver and is built with CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE enabled, which expose uninitialized stack data. No specific kernel version is listed in the CNA data, so all current kernels that ship with this driver and the mentioned configuration options are potentially impacted.

The CVSS base score of 4.1 indicates moderate severity, mainly reflecting a denial‑of‑service impact. The EPSS score of <1% shows a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker who can load or reconfigure the adf4377 driver—such as with local root or access to load kernel modules—could trigger the crash. No remote or privilege‑escalation vector is explicitly identified; exploitation requires local access to the affected device or driver configuration.