The vulnerability arises from a race condition between the Media‑2‑Media context release and the job start path in the amphion driver. The race allows the kernel to free a context that is still being used, leading to a use‑after‑free read fault and an immediate kernel panic. The primary consequence is a denial of service for the local system, as the crash requires no network interaction or additional privileges beyond the ability to trigger media jobs.

The flaw exists in the Linux kernel’s amphion media driver and affects any systems that include the vulnerable m2m framework implementation. No specific kernel release numbers are supplied, so all kernels containing the amphion driver prior to the patch are potentially impacted.

EPSS data is unavailable and the issue is not listed in CISA KEV, but the attack requires local user access with the capability to submit a media job. The race creates a use‑after‑free that can be triggered by a crafted sequence, so the risk is considered high. The likely attack vector is a local privileged or resident user who can invoke the media API to cause the crash.