The vulnerability occurs in the Rockchip PDM driver within the Linux kernel ASoC subsystem. The function that configures audio formats calls pm_runtime_get_sync() to resume the device, but it ignores the function’s return value. If the runtime resume fails, the driver continues to read and write hardware registers while the device remains unpowered, leading to an undefined hardware state and kernel crashes. Because the function does not check the return status, the crash can be triggered by any operation that causes the driver to try configuring the device while it is powered off, resulting in a denial of service for the system. The weakness involved is CWE-252, an improper check before execution.

All Linux kernel releases containing the unchanged Rockchip PDM driver code are potentially affected. The vendor is the Linux kernel itself; no specific version range is enumerated, so any kernel that has not yet incorporated the fix is at risk.

The likely attack vector is local, as an attacker would need to induce a runtime PM resume failure or trigger the driver to access the device while it is unpowered. The EPSS score indicates a very low exploitation probability of <1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low to moderate overall risk. However, the lack of proper error handling can result in kernel instability, so mitigation should be prioritized.