The Linux kernel VFIO PCI driver originally exposed the disable_idle_d3 module parameter as a global writable flag. Subsequent changes latched the value at module initialization and introduced reference‑counted power‑management operations via runtime PM. If the global value is altered through sysfs or across module reloads, the power‑state get/put counts can become unbalanced, causing a device to remain in a low power state or become unresponsive. This mismanagement of a shared resource constitutes a reference‑counting flaw.

All Linux kernel builds that include the VFIO PCI driver are affected. No specific version range is listed, so any distribution using a kernel that incorporates the original global disable_idle_d3 parameter and the runtime PM changes is potentially impacted.

The CVSS score of 5.5 indicates medium severity, but the EPSS score of <1% shows a very low probability of exploitation, and the flaw is not listed in CISA KEV. Exploitation would require privileged access to modify sysfs entries or reload the VFIO PCI module, implying a local or privileged attack surface. If successful, an attacker could induce device instability or a denial‑of‑service condition on the affected system. While the likelihood remains low, the impact on availability could be moderate to high should an exploit be discovered. No publicly known exploit has been reported.