The issue is related to a race condition during the initialization of the pmic glink child drivers in the Linux kernel. As pointed out by Stephen Boyd, the protection-domain notifiers may fire and schedule associated work before the client registration returns, resulting in a NULL pointer dereference as the `client` pointer is blindly dereferenced. This occurs when the protection domain registry is populated at the time of registration, which became more likely with the introduction of the commit '1ebcde047c54 ("soc: qcom: add pd-mapper implementation")'. The vulnerable code is identical across the altmode, battery manager, and usci child drivers.