The bug occurs when a background job in the DRM scheduler is terminated; scheduled fences that other jobs depend on are not signaled, leaving dependent jobs waiting forever. The result is that the dependent application stalls indefinitely, effectively denying service to that process. The weakness is a resource deprivation flaw, identified as CWE‑667, where a killed entity fails to clean up a needed synchronization object.

All versions of the Linux kernel that contain the DRM scheduler component are affected. The specific version range is not listed, so any current release lacking the fix should be considered vulnerable. The vendor is the Linux team.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not present in the CISA KEV catalog, implying no widespread known exploits. An attacker would need local or privilege escalation capability to trigger the failing kill sequence, making the attack vector likely local. In practice, the risk is moderate but should not be ignored on systems where DRM scheduler jobs are critical.