The vulnerability resides in the Linux kernel’s DRM execution logic, where the function that prepares an array of objects suppresses its locking routine when the array length is zero. If a driver makes successive calls, one with actual objects and one with an empty array, a contended execution state remains set. The retry mechanism then spins forever, causing the kernel to hang and the graphical session to stall. This behavior illustrates an infinite loop (CWE-835) that ultimately denies availability for users of the affected subsystem.

All Linux kernel builds that include the DRM subsystem before the fix that added a direct lock call for zero‑length arrays are affected. Systems running GPU drivers, such as AMDGPU’s userq signal/wait ioctls that chain multiple run‑throughs of the preparation routine, are the most susceptible. No specific version numbers are provided, so any kernel prior to the commit is considered vulnerable.

The flaw results in a moderate‑severity local denial‑of‑service, as indicated by the CVSS score of 5.5. The EPSS score of less than 1 % denotes a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no current widespread exploitation. An attacker must trigger the affected ioctl sequence to cause the infinite loop; the requirement for elevated privilege is not explicitly stated in the CVE, and the exploitation path depends on the user’s ability to invoke the DRM ioctl on the system’s GPU device nodes.