A null pointer dereference occurs in the hvs and v3d DRM drivers when their unbind functions are called after the master vc4 driver has been removed. This results in a kernel panic, leading to a denial of service. Based on the description, it is inferred that the flaw manifests only when an unbind operation is triggered, which typically requires a user‑or‑kernel‑level process capable of unloading modules or interacting with device nodes.

All Linux kernel builds that include the drm/vc4 hvs and v3d drivers and lack the patch commit 261f0a3f0ac03248284f5116d3258f89c9642215 are affected. The vulnerability is present in any kernel version prior to the application of this commit. The affected products are described as Linux kernel in the CPE entries.

The flaw requires that an attacker is able to trigger the unbind path, which typically means local access or elevated privileges on the target system. It is inferred that the attacker must have local or elevated privileges to trigger the unbind path. The EPSS score is not reported and the vulnerability is not listed in the CISA KEV catalog. While the CVSS score is not provided, the impact of a kernel crash makes this a high‑severity local denial‑of‑service issue. Because the exploit relies on a kernel exception caused by a null dereference, automatic exploitation is unlikely unless the attacker can force the module unload or device removal sequence. It is inferred that without the ability to forcibly unload the module or remove the device, automatic exploitation is unlikely.