The fault involves timer handling in the Broadcom (BCM) driver of the Linux kernel. A bug existed where the timer was scheduled in a mode that executed the callback via a tasklet, potentially leading to inappropriate scheduling or interrupt context usage. The vendor applied a fix that switches the timer to HRTIMER_MODE_SOFT, causing the callback to run in softirq context and removes the hrtimer_tasklet. This alteration mitigates the risk of driver instability or a kernel crash that could occur when the timer logic misbehaves.

All Linux kernel builds that contain the unpatched BCM driver code before the availability of the change are potentially affected. Linux kernel products from the Linux community are the relevant vendor and product. Version specifics are not supplied in the provided data; the vulnerability applies to any kernel version where the relevant BCM driver code appears prior to the patch commit.

The CVSS score of 7.8 classifies the issue as medium‑to‑high severity. The EPSS score of less than 1% indicates that the likelihood of active exploitation is very low. The vulnerability is not listed in the CISA KEV catalog. No remote attack vector is documented; to exploit the flaw an attacker would likely need kernel or privileged access, implying a local privilege escalation or denial‑of‑service scenario.