This vulnerability occurs in the Linux kernel’s drm/v3d driver when a local user crafts an ioctl extension that creates a self‑referential singly‑linked list. Because the driver does not bound the list length, an extension with both in_sync_count and out_sync_count set to zero bypasses existing validation checks and causes the kernel to walk an infinite loop. This lack of input validation is a CWE‑606 vulnerability. The loop blocks the calling thread and can pin a CPU core indefinitely, effectively exhausting kernel resources for that thread.

The bug affects all Linux kernel releases that contain the unpatched drm/v3d driver. Specific version numbers are not supplied in the advisory, so any kernel built before the patch should be considered vulnerable.

The CVSS score is not provided and the EPSS is unavailable; the vulnerability is not listed in CISA KEV. The attack requires local privilege to invoke the relevant ioctl, so a compromised or untrusted user on the system can intentionally trigger the denial of service. The loop runs in kernel mode and does not involve network exposure.