The defect arises in the airoha watchdog driver within the Linux kernel. If the clock provider is misconfigured or unmanaged, clk_get_rate() may return a value of zero. The driver then uses this zero value as a divisor to calculate watchdog timings, causing a division‑by‑zero error. This software fault can trigger a kernel panic, leading to an immediate system reboot and loss of availability. The vulnerability does not expose data directly but can be used to destabilise the affected system.

All Linux kernel installations that include the airoha watchdog driver are potentially affected. The description does not specify particular kernel releases, so any kernel build that incorporates the airoha driver prior to the patch commit is vulnerable. Systems running servers, embedded devices, or appliances that rely on the airoha hardware watchdog should review their kernel version and configuration.

The CVSS base score of 4.4 indicates a medium severity assessment. The EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Since the bug requires the driver to be loaded and a zero frequency clock to be present, an attacker would need local or privileged access to manipulate the clock configuration or trigger the watchdog. Public exploitation evidence is absent; while the likelihood of exploitation is low, the impact is a kernel crash that can deny service, so patching is still recommended.