The flaw in the i2c_imx driver disables the I2C clock before changing the pin‑control transition fails, the routine aborts while leaving the clock disabled, and a subsequent access to the hardware causes a kernel panic. A similar ordering issue exists in resume the pin‑control state. This ordering error (CWE‑367) can crash the kernel, leading to a denial of service by preventing normal operation of the system.

Linux kernel builds that compile the i2c_imx driver and have not incorporated the commit that reorders the clock and pin‑control calls are affected. All kernel sources dated before the patch are vulnerable, regardless of specific kernel version or configuration, as the issue is in the driver code rather than a configurable option.

The CVSS score of 5.5 indicates medium severity. An EPSS score of less than 1% implies a very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. It is inferred that the attack vector requires local user privileges to trigger a runtime suspend/resume cycle and force a pin‑control failure, making remote exploitation unlikely. Overall risk is moderate, centered on potential local denial of service for systems running the affected driver.