The vulnerability arises when the VC4 DRM driver reuses a 16MB binning buffer without clearing the Tile State Data Array (TSDA). Each slot originally held a job’s TSDA and tile allocation pool, and because the buffer is not zeroed, stale state from a previous job can be consumed by the GPU’s PTB hardware. The resulting invalid command streams and primitive branches can cause the GPU to hang, potentially leading to kernel or GPU process crashes and denying service to the system.

All Linux kernel releases containing the VC4 DRM driver are affected because the flaw is present until the zeroing patch is applied. The description does not list specific kernel versions, so any system with VC4 GPU support that has not yet incorporated the patch remains vulnerable.

There is no CVSS or EPSS score reported, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the user‑space DRM interface that submits rendering jobs; an attacker with the ability to submit jobs could trigger the stale TSDA logic. Although no public exploit is noted, the presence of a kernel memory bug that can lead to a GPU hang suggests a moderate to high risk of denial of service on affected systems.