The vulnerability arises from an incorrect unit conversion in the Davinci I2C driver. When a device tree omits the expected "clock-frequency" property, the driver falls back to DAVINCI_I2C_DEFAULT_BUS_FREQ, defined as 100 kHz. The code divides this value by 1,000 to convert to hertz, truncating the result to zero. Subsequent calculations that divide by the bus frequency then trigger a deterministic division‑by‑zero, causing a kernel panic. The weakness is a divide‑by‑zero error (CWE‑369) leading to a denial of service that can crash the entire system.

The flaw exists in the Linux kernel, specifically the Davinci I2C driver. The affected vendor is Linux, and the product is the Linux kernel. No specific kernel version range is listed, so any kernel containing the unpatched davinci driver before the correction of the macro conversion is susceptible.

The CVSS score is 5.5, indicating medium severity. The EPSS score is less than 1 percent, indicating a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the driver to load on hardware using the Davinci I2C controller and to present a device tree lacking the clock‑frequency entry; this is a local privilege scenario rather than remote. Because the failure is deterministic, a suitably privileged attacker can reliably trigger a kernel panic, but the limited attack surface and low exploitation probability keep the overall risk moderate.