The vulnerability in the Linux kernel IPMI driver arises when try_smi_init() attempts to register the IPMI interface but fails to get the BMC device ID. On failure, the driver cleans up state but does not set the in_shutdown flag, allowing asynchronous work (redo_bmc_reg) to retry device ID probing using a freed pointer. This results in a NULL pointer dereference in start_kcs_transaction(), causing a kernel crash. The fix sets the in_shutdown flag before invoking the lower driver's shutdown callback to prevent retries on a cleaned-up interface.

This vulnerability can cause a kernel NULL pointer dereference leading to a system crash (kernel panic). It affects system stability but does not directly indicate privilege escalation or information disclosure. No known exploits in the wild have been reported.

A fix is available and has been applied to the Linux kernel to set the in_shutdown flag during the failed registration rollback path, preventing retries on a cleaned-up interface. Users should update to the fixed kernel version once available. Patch status is not explicitly stated in the input, so check the vendor advisory for current remediation guidance.