The vulnerability resides in the Linux kernel regulator subsystem. A function creates an array to return to callers but only populates the consumer field of each element, leaving the supply name field uninitialized. When that array is subsequently used by regulator_bulk_enable, the code dereferences the missing supply name, causing a use‑of‑uninitialized memory error that can lead to a kernel panic or corruption. The primary impact is a denial of service due to system instability; accidental memory corruption could also occur, but the code path does not provide a clear attack vector for arbitrary code execution.

Affected systems are Linux kernels, specifically any configuration that enables regulator devices whose bulk enable path calls regulator_bulk_enable with the array returned by of_regulator_bulk_get_all. No specific kernel versions are listed here, so any kernel that contains the patched function exposed prior to the fix may be vulnerable.

The flaw does not expose an explicit user‑controlled input, so exploitation is limited to triggering a crash. The exploit requires the construction of a regulator bulk array via the specified function, which is typically invoked by kernel device drivers. Without a deliberate attack surface, the risk is low. The CVSS score of 4.1 places the vulnerability in the low severity range. The EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likelihood of exploitation is uncertain, but the absence of publicly documented exploitation reduces concern.