The Linux kernel function platform_get_irq_byname returns a negative code when an error occurs. The current implementation assumes a non‑negative value and passes the result directly to devm_request_threaded_irq. This omission can cause the driver to be registered with an invalid IRQ number, leading to unexpected kernel behavior, driver failures, or system crashes. The flaw represents a failure to validate return values, which may expose the system to denial‑of‑service conditions or other unintended states.

All Linux kernel releases that include the drm/vc4 driver and rely on platform_get_irq_byname without the error check are affected. The vendors impacted are Linux, product Linux kernel. No specific version range is listed, so any kernel that compiles the vcs driver before the fix is considered vulnerable.

The CVSS score is not disclosed and EPSS is not available, making quantitative risk assessment difficult. The vulnerability is listed in no KEV catalog, indicating no known widespread exploitation. Exploitation would require an actor able to influence the device initialization path, typically through a custom or malicious kernel module or by altering the hardware configuration to trigger the problematic code. While a local attacker with kernel module load capability could induce a crash or denial of service, remote exploitation is unlikely without additional vectors.