This vulnerability occurs in the Linux kernel’s MMC SDHC host controller driver for i.MX platforms. The code incorrectly uses pm_runtime_get_sync() while performing a suspend, which fails to decrement the power‑management usage counter if the subsequent resume operation fails. The device then remains unclocked, and any attempt to access its hardware registers triggers a kernel panic. The effect is a denial of service: the host can be rendered unusable when the driver is exercised under failure conditions.

The flaw affects any Linux kernel that embeds the sdhci‑esdhc‑imx driver without the commit that replaces pm_runtime_get_sync() with pm_runtime_resume_and_get(). Users running an i.MX platform with the sdhci‑esdhc‑imx module predating the fix are at risk. Distribution maintainers should verify that their kernel packages contain the update or have upgraded to a kernel version that includes the change.

Because the issue leads to a kernel panic, it constitutes a high‑impact denial of service vulnerability. The exploit likely requires triggering a suspend on the affected SD host controller when the power resume fails, which can be achieved by manipulating the SD card interface or by loading malicious kernel modules that exercise the driver. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog; however, the described crash capability warrants significant attention from system administrators.