The accel/qaic driver contains a flaw (CWE‑415 and CWE‑772) where deactivation messages from a device are dropped if the owning user process terminates before the host handles them. As a result, the device continues to believe the DBC is in use and never releases it unless the device is physically removed. When a subsequent user attempts to activate that same DBC, the driver indefinitely waits for the in‑use flag to clear, causing the process to hang. This manifests as a denial‑of‑service condition for components that rely on the QAIC subsystem.

Linux kernel builds that include the accel/qaic driver are affected. No specific kernel versions are listed in the CVE record; administrators should verify whether their running kernel contains the commit that introduced the fix or upgrade to a kernel version that includes the patch.

The CVSS score of 7.8 indicates high severity. Because the EPSS score is < 1%, the exploitation probability is low, although the vulnerability resides in kernel driver code and requires local access to the QAIC interface. The likely attack vector is an attacker who controls a user process that owns a DBC and terminates it prematurely; this is inferred from the description and not directly stated in the input. The consequence is a hang and resource freeze that can affect subsequent users, but it does not compromise confidentiality or integrity. The vulnerability is not listed in the CISA KEV catalog.