The vulnerability is a race condition between the workqueue task rzv2h_ivc_transfer_buffer() and other contexts that manipulate rzv2h_ivc::buffers.queue without holding the spinlock. This allows the list to be concurrently modified, potentially causing list corruption and leading to kernel panics or uncontrolled memory states. The flaw is identified as CWE-821, highlighting the lack of proper mutual exclusion. Based on the description, the likely attack vector is a privileged kernel context that can trigger the race condition.

All Linux kernel installations that contain the rzv2h-ivc media driver and have not incorporated the patch committed in 2026 are affected. The patch identifiers point to commits 72773ff1cdfaebc593f53b1719b2c1773ecf8c43 and c746522bd3264132ab2e2382e96e19cdb8a6c1ba, indicating that the issue was addressed in a kernel release after those changes. Users of any distribution employing the default kernel, the standard kernel maintenance stream, or backported kernel branches before the fix are potentially impacted.

The CVSS score of 7.8 indicates moderate to high severity, while an EPSS score of less than 1% suggests exploitation attempts are currently rare. The vulnerability is not listed in the CISA KEV catalog, indicating limited active exploitation. There is no known public exploit, and the flaw requires a privileged, kernel-level context to trigger the race condition. Based on the description, the likely attack vector is a privileged kernel context. Therefore the real-world risk is low to moderate, but patching remains recommended to eliminate the possibility of a kernel crash.