The vulnerability exists in the DRM Imagination driver’s soft reset routine of the Linux kernel. The routine runs from a threaded IRQ handler and mistakenly calls disable_irq(), which waits for IRQ handlers to finish, including itself, leading to a deadlock that stalls kernel execution and effectively renders the system unavailable until reboot.

Linux kernel images that include the unpatched drm/imagination driver are vulnerable. The advisory specifically names kernel versions 7.0 RC1 through RC4, so any kernel built with these releases prior to the patch is affected. Kernels using earlier or later releases may also need verification if the driver code was present, but the listed versions represent the confirmed vulnerable range.

The CVSS score of 5.5 classifies the vulnerability as moderate severity. EPSS is reported as less than 1 %, indicating a low probability of exploitation. The CVE does not appear in the CISA KEV catalog. Because the documentation does not provide an attack vector, it is inferred that an attacker would need the ability to trigger the device’s soft reset routine, which would typically require local privileged or kernel‑level access. The threat is predominantly a denial of service; no indication of confidentiality or integrity compromise is supplied.