The Linux kernel’s graphics driver contains a flaw that does not explicitly validate the minimum and maximum vertical frequency values supplied via EDID for variable refresh rate (VRR). If an attacker supplies a zero min_vfreq, a division operation in intel_vrr_compute_vmax() will trigger a divide‑by‑zero error, potentially causing the kernel to panic. This flaw manifests as a denial of service that results in a system crash and loss of availability. The weakness corresponds to a divide‑by‑zero bug, captured by CWE‑369.

The issue exists in the Linux kernel, affecting all versions prior to the inclusion of the fix referenced by commit 1765cf59f517b02f3b0591fe5120930d08bddeb6. Vendors distributing kernels that include this bug, including the mainline Linux distribution kernels, are affected. No specific product or patchlevel is enumerated in the CVE data beyond the generic Linux kernel.

The CVSS score of 5.5 indicates medium severity, suggesting that the vulnerability could impact system availability but is less likely to lead to critical compromise. The EPSS score of < 1% signifies a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely local or privileged, inferred from the need to provide malformed EDID data to the graphics driver; however, the CVE description does not explicitly state how an attacker could supply such data. Given the potential to crash the system via a division‑by‑zero, this vulnerability remains a medium‑risk concern for affected installations.