The vulnerability arises from an imbalance in runtime power‑management reference counting within the QCOM iris driver, which can lead to lingering references when the driver fails to correctly resume or release a power domain. This mismatch can cause power‑state inconsistencies, device hangs, or kernel crashes, representing a resource‑management weakness aligned with CWE‑772 and CWE‑399.

All Linux kernel installations that include the QCOM iris driver without the applied patch are affected. The issue is present in the kernel source tree, so any kernel version that has not incorporated the referenced commit fixes is at risk.

The CVSS score is not disclosed in the provided data; EPSS is unavailable, and the vulnerability is not listed in CISA's KEV catalog. The flaw requires local kernel or driver access and would likely be limited to attackers with privileged access. While the potential impact is significant—allowing kernel instability and power‑management failures—the lack of publicly available exploits and the need for elevated privileges reduce the immediate risk level.