A flaw in the Linux kernel drm/display driver performs a negative shift when the variable vcpi becomes zero during a delayed destroy task. The calculation attempts to create a payload mask using the expression ~BIT(vcpi‑1), which, when vcpi is zero, results in a shift‑out‑of‑bounds error that UBSAN reports and causes a kernel panic. This crash brings the system down and may force a reboot or cause the X session to terminate. The weakness is an improper validation of an integer used in a bit‑shift operation.

This issue exists in any Linux kernel that contains the DRM DP MST code without the protective check. Until the commit 342ccffd9f77fc29fe1c05fd145e4d842bd2feaa is applied, all kernels released before that commit—including kernel 6.17.x and earlier—are vulnerable. The affected product is the Linux kernel, maintained by the Linux community.

The CVSS score of 5.5 indicates moderate severity. EPSS is below 1% and the vulnerability is not listed in CISA KEV, suggesting a low to medium likelihood of active exploitation. The likely attack vector is local with elevated privileges, as an attacker would need to trigger a DP 2.1 monitor disconnect during a queued delayed destroy work item. This results in a denial of service via a kernel crash, potentially halting the system or forcing a reboot. Administrators should treat this as an urgent local denial‑of‑service risk until a kernel update is installed.