Unconditionally whitelisting of OA registers in the Linux kernel creates a security violation that could allow an unprivileged process to gain privileged access to hardware registers after probe, reset, resume, or engine reset events. The added RING_FORCE_TO_NONPRIV_DENY bit prevents such registers from being whitelisted by default, thereby mitigating unauthorized access. The vulnerability therefore enables a potential privilege escalation attack where a local attacker could manipulate low‑level hardware resources.

The flaw is present in the Linux kernel itself, affecting all builds that lack the patch commit 90511bdcfda97211c01f1d945d4ea616578d8fca. No specific kernel version range is provided; the vulnerability applies to any kernel that still uses the unprotected whitelist behavior.

The CVSS score is 7.0 and the EPSS score is < 1%, indicating moderate severity and a low but non-zero exploitation probability. However, since the weakness involves kernel register whitelisting, an attacker would need local kernel code execution to exploit it, making the attack vector a local privilege escalation scenario. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been reported as of the last update. Nonetheless, the potential for privilege escalation warrants prompt mitigation.