The vulnerability arises when the jz4780 I²C controller driver calls clk_get_rate() during an active I²C transfer, forcing the Common Clock Framework to acquire its global prepare_lock mutex while the driver holds the I²C bus lock. A second transfer on the same bus can also trigger clk_get_rate(), attempting to obtain the already held prepare_lock and creating a circular dependency that deadlocks the system. The result is a denial of service, as the kernel freezes and cannot process further requests. The weakness is a race/locking flaw (CWE‑833).

This flaw affects Linux kernel builds that include the jz4780 I²C host controller driver, a component found in many Allwinner SoCs and other embedded platforms. The specific kernel versions are not listed in the advisory, but the fix appears in recent kernel sources cited in the references.

The EPSS score of <1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.5 reflects moderate severity. A likely attack vector involves an attacker who can influence I²C transactions on the bus, such as by controlling an attached clock generator or GPIO expander. This typically requires local presence or a device that can directly affect the I²C bus, so the threat is most acute for systems with exposed or user‑controlled I²C devices. The low EPSS score suggests exploitation is unlikely, but the potential impact is significant.