This vulnerability occurs in the Linux kernel’s MMC SDHC host controller driver for i.MX platforms. The code incorrectly uses pm_runtime_get_sync() while performing a suspend, which fails to decrement the power‑management usage counter if the subsequent resume operation fails. The device then remains unclocked, and any attempt to access its hardware registers triggers a kernel panic. The effect is a denial of service: the host can be rendered unusable when the driver is exercised under failure conditions.

The flaw affects any Linux kernel that embeds the sdhci‑esdhc‑imx driver without the commit that replaces pm_runtime_get_sync() with pm_runtime_resume_and_get(). Users running an i.MX platform with the sdhci‑esdhc‑imx module predating the fix are at risk. Distribution maintainers should verify that their kernel packages contain the update or have upgraded to a kernel version that includes the change.

Because the issue leads to a kernel panic, it constitutes a denial of service vulnerability. The CVSS score of 5.5 indicates a moderate impact. The exploit likely requires triggering a suspend on the affected SD host controller when the power resume fails, which can be achieved by manipulating the SD card interface or by loading malicious kernel modules that exercise the driver. Based on the description, it is inferred that these exploit paths are derived from the known flaw metrics. The EPSS score indicates a low probability of exploitation (<1%) and the vulnerability is not listed in CISA KEV, yet the potential for a system crash warrants continued attention from system administrators.