The Linux kernel’s PowerVR DRM driver contains a bug where the function pvr_vm_context_lookup() returns either NULL or a valid pointer, but the code mistakenly treats this return value as an error pointer via IS_ERR(). When NULL is returned, the driver dereferences it, causing a kernel null pointer exception and a system oops. An attacker can trigger this by passing an invalid VM context handle through the DRM_IOCTL_PVR_CREATE_CONTEXT ioctl, which brings the host down with a complete kernel crash.

All Linux kernel builds that include the PowerVR DRM driver are susceptible. This includes any distribution or custom kernel where the powervr module is built into or loaded as a module, as shown in the provided trace. The vulnerability is independent of distribution vendor; it depends solely on the presence of the buggy driver code.

The flaw leads to an unavoidable kernel crash, a high‑severity outcome. No CVSS score is listed, but the nature of the error (NULL dereference) yields a severe impact. EPSS data is unavailable and the issue is not in the CISA KEV catalog, indicating limited public exploitation evidence. The likely attack vector is local; a user with permission to access /dev/dri/pvr (typically members of the video group) can craft the malicious ioctl to crash the kernel.