The Linux kernel’s VC4 DRM driver contains a synchronization issue where the BO cache timer is not fully shut down before the cache is destroyed. The timer’s callback can rearm the timer through workqueue code, and because the work is cancelled after the timer deletion, a race can allow the timer to fire again. This cycle can eventually exhaust kernel resources or trigger a crash. The flaw is a resource cleanup error (CWE-821). Based on the description, the deficiency can be exploited only by code that can invoke VC4 DRM functions, i.e., it is a local‑privilege or kernel‑mode execution scenario, which is inferred from the driver–kernel interaction.

Any Linux kernel build that includes the VC4 DRM driver with the buggy timer logic is affected. The vendor is Linux, the product is the Linux kernel—specifically the VC4 DRM subsystem. No precise version range is listed; therefore, any kernel before the commit that replaces timer_shutdown_sync with the proper shutdown sequence may be impacted.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% shows that exploitation is considered unlikely in the near term. The vulnerability is not listed in the CISA KEV catalog, further implying limited public exploitation. However, because it can lead to a kernel crash if the race condition is triggered, it is a local‑only denial‑of‑service threat that requires privileged access to the driver’s API.