The bug exists in the VC4 DRM driver of the Linux kernel. It stems from the binner buffer, a 16 MB region split into 512 KB slots, that is reused for each rendering job without clearing its contents. Each slot contains a Tile State Data Array (TSDA) used by the PTB hardware. Because the driver fails to zero this data before handing the slot to a new job, stale TSDA information from a previous rendering pass can be processed. This results in malformed command streams and invalid PRIM or BRANCH commands, which in turn can cause the GPU to hang, potentially propagating a kernel or process crash and denying service to users.

All Linux kernel builds that include the VC4 DRM driver before the zeroing patch are affected. The flaw is present in all releases until the driver commit that adds zeroing is merged into the kernel; therefore any installation with VC4 GPU support that has not applied the patch remains vulnerable.

The CVSS score is 7.8 and the EPSS score is < 1%, indicating a low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is via the DRM user‑space interface: an attacker who can submit rendering jobs to the VC4 driver can trigger the stale TSDA logic. No public exploit is documented, but the presence of a kernel bug that leads to GPU hangs makes it a moderate to high risk for denial of service on affected systems.