During GPU device initialization on LoongArch systems, the loongson_gpu_fixup_dma_hang() function can compute an incorrect register address and read from it with readl(). Because the address is random and often invalid, the kernel triggers an Access Data Exception (ADE) that results in a panic. The fault is a direct out‑of‑bounds memory read, causing a catastrophic loss of availability for the affected system. The underlying weakness maps to an improper restriction of operations within the bounds of a memory buffer.

All Linux kernels compiled for the LoongArch architecture that include the Loongson GPU driver are affected. The CVE covers any firmware that enables a discrete Loongson LG100 GPU during boot or runtime, such as recent 6.6 kernel releases prior to the fix commit. Vendor information is provided by the Linux kernel project; the specific affected versions are those built before the patch commit referenced in the advisory.

Based on the description, it is inferred that the vulnerability does not have a publicly available remote exploit; the attacker must trigger PCI device enumeration for a Loongson GPU, implying a local privilege requirement. The EPSS score of 0.00032 (<1%) indicates a very low exploitation probability, and the CVE is not listed in CISA KEV. The CVSS score of 5.5 reflects a medium severity for this kernel panic. Given the severity of a kernel panic, the overall risk is considered high for impacted systems until a patched kernel is installed.