This vulnerability is a race condition caused by an uninitialized state mutex in the Linux kernel’s Industrial I/O (IIO) driver for AXI ADC devices. The mutex should protect register access paths, but the probe function does not initialize it before registering the backend. This oversight allows concurrent access to the device registers, potentially corrupting internal state and leading to a kernel panic or denial of service. The weakness fits CWE-908 (Race Condition).

The flaw affects the Linux kernel, specifically the IIO subsystem driver for AXI ADC (adi-axi-adc). No precise version range is listed; any kernel that contains the bug before the referenced commits is considered vulnerable. The patch is introduced in recent kernel commits and is available in modern kernel releases.

The CVSS score of 5.5 denotes a moderate severity, while the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would need either local privileged access or the ability to load the affected module. Once the race condition is triggered, the system could experience a crash or service interruption. Applying the upstream patch eliminates the risk.