The flaw lies in the Linux kernel’s rz_mtu3 module, where repeated writes to the sysfs enable file adjust a runtime power‑management counter without bounds checking. Because the kernel does not validate the current counter state before incrementing or decrementing, repeated writes can cause the counter to under‑flow or over‑increment. The resulting counter mis‑management triggers erroneous hardware register accesses, optionally disabling clocks or prematurely stopping PWM operations. This flaw is a counter manipulation vulnerability (CWE‑911).

Any Linux kernel build that includes the rz_mtu3 driver is affected. The CPES list indicates kernels from Linux 7.0 rc1 through rc6 and all subsequent kernels that include this module may be vulnerable until the fix is applied. No specific version range was formalized in the advisory, so all builds shipping the module could be impacted.

The vulnerability can be triggered by writing to the /sys/class/rz_mtu3/.../enable file. The likely attack vector is a local attacker who has write access to that sysfs entry; typically this requires local privileged or root access, but the exact privilege level is not explicitly stated in the advisory and is inferred. The EPSS score of <1% indicates a very low probability of exploitation, and the CVSS score of 5.5 reflects a moderate severity rating. The flaw is not listed in the CISA KEV catalog. Exploitation would result in counter underflow, incorrect clock states, and potential interruption of PWM operations.