A defect in the Linux virtio-gpu DRM driver causes the driver to access data that has never been initialized when the kernel mode setting (KMS) feature is disabled. The uninitialized pointer is dereferenced during driver removal or unbinding, resulting in a kernel panic that brings the system down. This flaw effectively makes the host unavailable for legitimate users and can be leveraged by an attacker to trigger a denial‑of‑service. The weakness is an instance of improper initialization leading to uninitialized data usage.

All Linux kernel builds that include the virtio-gpu driver compiled with KMS disabled are affected. Since the commit that removes the shutdown of the atomic core when KMS is unavailable is not present in earlier kernels, any kernel version prior to that commit is potentially vulnerable. The vulnerability is not tied to a narrow version range and applies across distributions, as indicated by the generic Linux kernel CPE string.

The lack of an EPSS score and the exemption from the CISA KEV catalog indicate that no widespread exploitation is documented. However, the impact of a kernel crash is severe. The flaw is presumably exploitable only by processes that can load and unload kernel modules or influence device binding, which typically requires privileged or root access. An attacker with such privileges could intentionally unload the virtio-gpu driver while KMS is disabled to force a system reboot. Although no public exploit exists, the severity of the crash warrants prompt remediation.