The flaw in the i2c:imx driver causes an invalid block read length to set the interface state to a failure condition, but the interrupt handler subsequently overwrites this state unconditionally. The result is an endless read loop that overruns internal buffers and crashes the kernel. The vulnerability therefore leads to a denial of service by causing a kernel panic.

Vulnerability presence is identified in the Linux kernel versions referenced by the given CPE entries, which include the generic linux_kernel family and the pre‑release 6.19rc1 through 6.19rc8 releases. The specific affected kernel branches are not explicitly enumerated in the source data; users should consult the distributor or kernel maintainer to confirm whether the upstream commit (3f9b508b3eecc00a243edf320bd83834d6a9b482) has been incorporated.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is local: an adversary would need to interact directly with an I2C device managed by the imx driver or forward a malformed block read request, and remote exploitation would require privileged access to the target hardware. Because the flaw leads only to a crash, the primary risk is denial of service rather than arbitrary code execution.