A bug in the Linux kernel driver for the i.MX8ISi platform causes the driver to unconditionally purge the streaming queue when the device is released. The flaw can be triggered by simple commands such as "v4l2-ctl -l" issued during an active stream, leading to a kernel oops. The impact is a local denial of service because the kernel panic destroys integrity and availability of the full system, but it does not compromise confidentiality or expose data. The weakness is a failure to perform proper resource cleanup, which is reflected in the typical CWE category for improper resource management.

The affected product is the Linux kernel used on i.MX8MP boards and any other systems that load the driver from the nxp:imx8-isi media subsystem. The Vendor list lists only Linux; specific version information is not provided in the advisory, but the fix is present in kernel revisions that incorporate the change described in the commit series referenced in the CVE references.

The EPSS score is below 1 %, indicating that exploitation is unlikely in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, anyone who streams media with the imx8-isi driver and meanwhile queries the device’s capabilities or otherwise releases the device will experience a local denial of service. The attack vector is local via normal user commands; no network exposure is required.