The vulnerability originates in the RTC spear driver within the Linux kernel. The driver requests an interrupt before fully initializing its memory‑mapped I/O region and spinlock. Because devm_request_irq() enables the interrupt upon return, the interrupt handler can execute while the probe routine is still incomplete. If the handler runs with uninitialized data, it may read or write bogus kernel memory, resulting in a fault or corruption that can affect kernel stability.

All Linux kernel releases that incorporate the RTC spear driver before the commit that corrects the IRQ ordering are potentially vulnerable. The specific kernel versions are not enumerated in the advisory, so any build that contains the unpatched driver prior to the aforementioned fix should be considered at risk.

The CVSS score of 4.1 suggests a moderate severity, while the EPSS score of <1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a local interaction with the RTC device or the trigger of its interrupts. The weakness is a concurrency access issue (CWE-366).