The vulnerability arises from an incorrect handling of the NOC_HDCP clock during a NoC ADB400 port power‑down handshake, a weakness classified as CWE‑413: Incorrect Interface Usage. The driver may disable the clock, causing the handshake to stall and potentially leading to a kernel hang. A patch that forces the clock to remain enabled fixes the problem and prevents the denial of service.

The vulnerability is present by default in Linux kernel 6.1 and all 7.0 release‑candidate builds (rc1 through rc7). It affects systems that load the imx8mp‑blk‑ctrl driver before the patch that keeps the NOC_HDCP clock enabled.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% shows a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker able to trigger the NoC ADB400 power‑down sequence, which is unlikely without privileged or kernel access or a component failure. Overall, the risk is low to moderate, but the potential impact on availability warrants timely remediation.