The vulnerability involves the VC4 buffer object cache timer in the Linux kernel. During teardown, the timer is deleted but the queued work can still rearm it, allowing the timer to continue firing after the cache has been destroyed. This race between timer deletion and work cancellation can lead to a loop that may exhaust kernel resources or trigger a crash. The flaw arises from improper synchronization between timer shutdown and workqueue cancellation.

The issue appears in the Linux kernel's VC4 DRM driver. No specific version numbers are listed; any kernel that includes the buggy logic before the patch may be affected. The vendor is Linux; product is the Linux kernel itself.

The CVSS score is not specified and EPSS is not available, so the public data does not quantify risk. The vulnerability is not in CISA KEV but it can be triggered by a process with kernel code execution privileges, making it a local‑only threat. Because the flaw only manifests under specific timing conditions, it is unlikely to be widely exploitable without prior privileged access. Nonetheless, the potential for a kernel crash makes it a moderate risk for impacted systems.