The vulnerability arises when the watchdog driver for the msc313e device calls a function to retrieve a clock rate that returns 0. The driver then attempts to divide by this rate, causing a division‑by‑zero panic that crashes the kernel. The weakened code does not validate the clock rate before division, a classic divide‑by‑zero flaw (CWE‑369). The resulting kernel crash forces a reboot or renders the system unusable, constituting a denial of service. The impact is localized to the affected host, but the full availability of that host is lost until a reboot or kernel reload occurs.

All Linux kernel installations that include the msc313e watchdog driver before the commit that added a guard against a zero clock rate are vulnerable. The advisory does not list specific kernel versions, so any distribution kernel containing the unpatched driver is potentially affected.

The CVSS score of 5.5 classifies this flaw as moderate severity. The EPSS score of less than 1% indicates that attackers are unlikely to encounter or exploit this weakness. Exploitation would require a scenario where the driver receives a zero rate, such as a malfunctioning device, a crafted firmware, or a privileged driver injected by an attacker. Because the watchdog subsystem is usually protected for privileged use only, an attacker would need local privileged access or physical control over the hardware, making the likelihood of successful exploitation low to moderate. The vulnerability is not listed in CISA’s KEV catalog, and no known active exploits have been reported.