The Linux kernel’s virtio‑gpu driver does not initialize the DRM atomic core and modesetting components when built with kernel mode setting (KMS) disabled. When the driver is later removed or unbound, the code accesses an uninitialized object, triggering an invalid memory read that causes a kernel panic. This fault is an instance of CWE‑824: Uninitialized Object and delivers a denial‑of‑service by crashing the entire kernel.

The flaw is present in any Linux kernel that includes a virtio‑gpu module compiled with kernel mode setting disabled. Systems running a kernel version prior to the recent patch, including those received through standard distribution updates, are susceptible. The vulnerability affects the virtio‑gpu driver when the DRM atomic and modesetting components are not initialized due to disabled KMS.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% reflects a very low current likelihood of exploitation. The flaw is not listed in CISA KEV. The likely attack vector is privileged kernel‑level actions, such as loading or unloading the virtio‑gpu module or manipulating device bindings, and this is inferred because the description references driver removal/unbinding. Any exploitation would be limited to users with kernel‑level privileges. No publicly available exploit has been reported, and a kernel crash would cause a denial of service for all users on the host.