The Linux kernel’s DRM/bridge driver th1520‑dw‑hdmi mishandles its private data during removal: the struct th1520_hdmi stored in platform drvdata is read as a different struct dw_hdmi type, and the wrong pointer is passed to dw_hdmi_remove(). This type confusion corrupts kernel memory and can trigger a kernel panic or give an attacker the ability to execute arbitrary code with kernel privileges if they can control the removal process. The impact described comes directly from the vulnerability description.

Linux distributions running kernel versions that include the th1520‑dw‑hdmi driver before the patch commit 01c83795d50ccdb441f60e89ff50767cb2f6045a are affected. Any kernel that ships the unpatched driver, regardless of vendor, is vulnerable.

The CVSS score of 4.4 places this issue in the low severity range, and the EPSS score of less than 1% indicates a very low exploitation likelihood. This vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector would involve local manipulation or unexpected hot‑plugging of the HDMI interface to trigger the removal path. If an attacker can cause the driver to be torn down, they could exploit the memory corruption to crash the kernel or gain elevated privileges, but in typical production environments the probability of such exploitation is considered low.