The unlink_nv12_plane() routine in the Intel i915 DRM driver overwrites parts of the plane state that have already been established by plane_atomic_check(). This behavior aligns with CWE‑366, which denotes unsafe handling of internal state that can result in corruption. The consequence is a warning followed by kernel data structure corruption, potentially causing crashes or undefined behavior within the graphics subsystem and denying service for processes that rely on the DRM interface.

Vulnerable kernels include Linux 6.15 and all 7.0 release‑candidate builds (rc1 through rc7). The flaw manifests on systems equipped with Intel i915 graphics hardware that interact with the DRM subsystem.

The CVSS score of 5.5 reflects moderate severity. An EPSS score of less than 1 % indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local user who can supply a DRM request that triggers the plane type change, making the attack vector local. An attacker would need to drive the driver into the problematic state transition; successful exploitation could crash the kernel or cause a denial of service for all graphics users.