The vulnerability arises from using the deprecated UNIVERSAL_DEV_PM_OPS() macro in the cdns-dsi driver. That macro triggers the same callbacks for both runtime and system suspend. Consequently, DSI clocks are disabled twice—once during runtime suspend and once again during system suspend—causing the clock framework to emit WARN messages and potentially mismanaging clock states. While this results primarily in noisy logs, the repeated disable could lead to unreliable power state transitions and degrade system stability during suspend cycles.

All deployments of the Linux kernel that include the cdns-dsi bridge driver and have not applied the upstream commit that replaces UNIVERSAL_DEV_PM_OPS() with RUNTIME_PM_OPS(). The exact kernel versions affected are not enumerated in the advisory; any kernel prior to the noted patch would carry the issue. The bug is confined to systems utilizing the cdns-dsi bridge and its associated panel drivers.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known exploited instances. Because the defect occurs inside kernel power‑management callbacks, a successful exploit would require root access or the ability to load a malicious kernel module, making it unlikely to be leveraged remotely. The impact is primarily negative on system reliability rather than a classic security breach. Therefore, the risk level can be considered low, but monitoring for warning messages remains prudent.