In Linux kernels that use the SiFive PLIC interrupt controller, changing an interrupt’s affinity while it is being serviced can cause the interrupt controller to ignore the completion signal, leaving the interrupt permanently disabled. This leads to a device, such as a UART port, becoming frozen, halting further data transmission and effectively disrupting I/O operations. The weakness is identified as CWE‑367, a concurrency/process control flaw that misses a proper check before acknowledging an interrupt completion.

The vulnerability affects any Linux kernel that integrates the SiFive PLIC driver without the recent fix that verifies the PLIC’s enable bit before sending an interrupt completion. No specific kernel release is named in the advisory, so any build that predates the patch that validates the enable bit may be vulnerable.

The CVSS score of 5.5 indicates medium severity focused on availability. The EPSS value of <1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need local or privileged access to modify interrupt affinity while traffic is occurring; without such access the freeze cannot be induced. Consequently the risk level is moderate, contingent on the attacker’s ability to change affinity and trigger the fault.