A flaw in the Linux kernel drm/display driver performs a negative shift when the variable vcpi becomes zero during a delayed destroy task. The calculation attempts to set the payload mask to ~BIT(vcpi‑1), which, when vcpi is zero, results in a shift‑out‑of‑bounds error reported by UBSAN. This causes a kernel panic and a system reboot or loss of the X session. The weakness is an improper validation of the vcpi value before it is used in a bit‑shift operation.

The flaw exists in any Linux kernel that includes the drm/display code without the fix. It was introduced before the commit that added the protection (c. 342ccffd9). Accordingly, all Linux distributions using kernel releases prior to that commit – for example kernel 6.17.x and earlier – are susceptible. The affected product is the Linux kernel, maintained by the Linux community.

Because the vulnerability is not listed by CISA KEV and EPSS score is < 1%, the likelihood of active exploitation is uncertain. The CVSS score of 5.5 reflects a moderate severity of the bug. The impact of a kernel crash is severe, but triggering the bug requires local control of the display subsystem – typically a user with the ability to disconnect a DP 2.1 monitor while a delayed destroy work item is still queued. This suggests the attack vector is local with relatively high privileges. Administrators should treat the issue as a high‑severity local denial‑of‑service risk until the kernel is updated or an official patch is applied.