The Linux kernel’s PowerVR DRM driver contains a bug where the function pvr_vm_context_lookup() returns either NULL or a valid pointer, but the code mistakenly treats this return value as an error pointer via IS_ERR(). When NULL is returned, the driver dereferences it, causing a kernel null pointer exception and a system oops. An attacker can trigger this by passing an invalid VM context handle through the DRM_IOCTL_PVR_CREATE_CONTEXT ioctl, which brings the host down with a complete kernel crash.

All Linux kernel builds that include the PowerVR DRM driver are susceptible. This includes any distribution or custom kernel where the powervr module is built into or loaded as a module, as shown in the provided trace. The vulnerability is independent of distribution vendor; it depends solely on the presence of the buggy driver code.

The flaw leads to an unavoidable kernel crash, which constitutes a denial of service. The CVSS score of 5.5 indicates moderate severity, but the impact on system stability is critical. The EPSS score is < 1%, showing a very low probability of exploitation in the wild; the issue is not listed in the CISA KEV catalog, indicating limited public exploitation evidence. The likely attack vector is local; a user with permission to access /dev/dri/pvr (typically members of the video group) can craft the malicious ioctl to crash the kernel.