The vulnerability occurs when the v3d DRM driver processes a userspace request to set up an indirect CSD job. The driver assumes the buffer object handle supplied by userspace is valid and uses drm_gem_object_lookup to obtain the indirect buffer object. If the handle is bogus or stale, the lookup returns NULL, which the driver stores and later dereferences when the job runs. The dereference causes a kernel null pointer fault, forcing the system to reboot. The impact is a denial of service; no code execution or information disclosure is afforded to the attacker.

This flaw is present in any Linux kernel that includes the v3d DRM driver prior to the patch. The driver is part of the kernel’s DRM subsystem for VideoCore graphics, used mainly on devices such as the Raspberry Pi. All distributions or custom images running a vulnerable kernel version are at risk, regardless of whether additional driver modules are loaded or not.

The flaw can be triggered by any userspace process that submits an invalid handle to the v3d driver, meaning local attackers can readily cause a kernel crash. No remote exploitation has been documented, and the EPSS score is < 1%, while the vulnerability is absent from the CISA KEV catalogue. Nonetheless, the potential for a kernel panic and the absence of mitigations beyond a patch elevate the risk. Attacker with local control can repeatedly crash the system, impacting availability but not confidentiality or integrity. The CVSS score of 5.5 indicates moderate severity.