The vulnerability arises from improper use of the __initconst attribute in the Verisilicon media driver within the Linux kernel, leading to a kernel paging request error when the driver is probed as a module. This causes a kernel panic, effectively crashing the system and denying service. The flaw is an example of CWE‑825, improper handling of data with incorrect lifetime annotations.

Affected only the Linux kernel media subsystem for Verisilicon devices. No specific kernel version range is listed, but any configuration that loads the hantro_vpu module remains vulnerable until the upstream fix is applied.

The CVSS score of 5.5 indicates moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not in the CISA KEV list. Attack feasibility requires the ability to load or reload the affected module, which typically requires administrative privileges or a local physical user with the ability to insert kernel modules. In such environments, an attacker could crash the system by triggering the probe sequence.