In the Linux kernel, the virtio‑gpu driver fails to initialize the DRM atomic core and modesetting components when built with kernel mode setting disabled. When the driver is later removed or unbound, the code accesses an uninitialized object, which triggers an invalid memory read and causes a kernel panic. This is an instance of CWE‑824: Uninitialized Object, resulting in a denial‑of‑service through kernel crash.

The vulnerability exists in any Linux kernel that includes a virtio‑gpu module compiled with KMS disabled. Distributions shipping kernels before the patch, including standard updates, incorporate the commit that guards against atomic core shutdown during removal.

The CVSS score of 5.5 reflects moderate severity, while the EPSS score indicates a very low current likelihood of exploitation. The flaw is not listed in CISA KEV. Exploitation would normally require privileged access to load or unload kernel modules or manipulate device bindings. No publicly available exploit has been reported, so the overall risk for an unpatched system remains low to moderate, but any kernel panic would result in denial of service for all users on the host. The likely attack vector is inferred to be privileged module loading or unloading performed by an attacker with sufficient kernel-level permissions.