A flaw in the Linux kernel drm/display driver performs a negative shift when the variable vcpi becomes zero during a delayed destroy task. The calculation attempts to set the payload mask to ~BIT(vcpi‑1), which, when vcpi is zero, results in a shift‑out‑of‑bounds error reported by UBSAN. This causes a kernel panic and a system reboot or loss of the X session. The weakness is an improper validation of the vcpi value before it is used in a bit‑shift operation.

The flaw exists in any Linux kernel that includes the drm/display code without the fix. It was introduced before the commit that added the protection (c. 342ccffd9). Accordingly, all Linux distributions using kernel releases prior to that commit – for example kernel 6.17.x and earlier – are susceptible. The affected product is the Linux kernel, maintained by the Linux community.

Because the vulnerability is not listed by CISA KEV and no EPSS score is available, the likelihood of active exploitation is uncertain. The impact of a kernel crash is severe, but triggering the bug requires local control of the display subsystem – typically a user with the ability to disconnect a DP 2.1 monitor while a delayed destroy work item is still queued. This suggests the attack vector is local with relatively high privileges. Administrators should treat the issue as a high‑severity local denial‑of‑service risk until the kernel is updated or an official patch is applied.