In Linux kernels that use the SiFive PLIC interrupt controller, changing an interrupt’s affinity while it is being serviced can cause the controller to ignore the completion message, leaving the interrupt permanently disabled. This leads to a device such as a UART port becoming frozen and halting I/O, effectively disrupting system availability. The weakness is identified by CWE‑367, a concurrency/process control flaw that omits a proper check before acknowledging an interrupt completion, and the vendor also lists NVD‑CWE‑noinfo, indicating an unspecified weakness in the documented control flow.

The vulnerability affects any Linux kernel that includes the SiFive PLIC driver without the recent fix that verifies the PLIC’s enable bit before sending an interrupt completion. No specific kernel release is named in the advisory; thus, any build predating the patch that validates the enable bit may be vulnerable.

The CVSS score of 5.5 indicates medium severity focused on availability. The EPSS value of <1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need local or privileged access to modify interrupt affinity while traffic is occurring; without such access the freeze cannot be induced. Consequently the risk level is moderate, contingent on the attacker’s ability to change affinity and trigger the fault.