The vulnerability is a race condition in the I²C designware driver for the amdisp device. It occurs when the runtime power‑management routine triggers an ISP power‑on during probe before the driver’s initialization completes, resulting in a NULL dereference that can crash the kernel and cause a denial of service. The flaw corresponds to CWE‑362 (Race Condition) and CWE‑367 (Improper Locking).

All Linux kernel releases up through the initial stable release of version 7.0, including kernel 6.16 and the 7.0‑rc releases 1–7, are affected. The issue existed from the outset of the driver; only the commit that reordered the PM calls in v7.0 applied the fix. Systems running any kernel that does not contain this commit are vulnerable.

The CVSS score of 4.7 places the flaw in the medium‑severity range, and the EPSS score of < 1 % indicates a very low observed exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local, as it requires the kernel’s probe routine to run during boot or when the device is enabled. An attacker with local or kernel privilege could trigger a kernel crash and cause a denial of service. The patch eliminates the race by calling the generic power‑domain API directly during probe, suspending the device afterward, and enabling runtime PM only after initialization.