The vulnerability resides in the Linux kernel interface for the VC4 DRM driver and arises from an improper cleanup of kernel‑mode setting (KMS) polling during module unbind. The driver calls drm_kms_helper_poll_init() but never calls the corresponding drm_kms_helper_poll_fini(), leaving a scheduled poll work item that continues to run after the device is freed. When the module is unloaded, the delayed work executes on a freed drm_device, triggering a use‑after‑free error that can be exploited to execute arbitrary code with kernel privileges.

Any Linux kernel installation that includes the vc4 DRM driver (typically those that support Broadcom VideoCore GPUs) is affected. The vulnerability applies to all kernel versions that compile the vc4 module without the recent patch, so systems with older kernels or custom builds that lack the corresponding commit are at risk.

The flaw is a classic use‑after‑free (CWE‑825) with moderate impact (CVSS 5.5), capable of privilege escalation to kernel mode and potentially remote code execution if an attacker controls module loading. An EPSS score of < 1% indicates a low probability of exploitation, and the issue is not listed in CISA KEV, but the absence of administrative oversight and the local nature of the exploitation vector still make it a high‑severity risk for systems that rely on the vc4 driver. The required conditions—loading and unloading the module while a delayed work queue remains active—are achievable by a local attacker with freedom to manage kernel modules, making the attack feasible in many realistic scenarios.