Linux Kernel EUVD-2026-25548

Exploitation requires: (1) physical or logical local access to a system running an affected Linux kernel version compiled with the imx8mp-blk-ctrl driver (AV:L/PR:L confirmed by CVSS vector); (2) the target hardware must be an NXP i.MX 8M Plus (i.MX8MP) SoC - this driver is not compiled or reachable on x86, ARM64 servers, Raspberry Pi, or other non-imx8mp platforms; (3) the system must reach a power management state transition that causes the NoC ADB400 domain power-down sequence to execute. No authentication beyond a low-privilege local session is required once on the correct hardware. Limiting factors: platform specificity to i.MX 8MP hardware drastically constrains the attack surface; the hang may also be triggered non-maliciously by normal idle/suspend cycles, meaning defenders should treat this as a reliability defect in addition to a security concern.

Real-world risk is moderate for affected embedded platforms and low across the broader Linux kernel user base. CVSS 3.1 scores this at 5.5 (Medium) with AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, accurately reflecting that exploitation requires local access with low privileges on specific NXP i.MX 8M Plus hardware. EPSS at 0.02% (5th percentile) confirms extremely low probability of opportunistic exploitation - this is consistent with an embedded-platform kernel stability defect rather than a broadly weaponizable flaw. The vulnerability is NOT in CISA KEV and no POC has been identified at time of analysis. The 'Information Disclosure' tag in the intelligence data appears to be a misclassification - the CVSS confirms C:N/I:N/A:H, meaning there is strictly an availability impact with no confidentiality or integrity exposure. For organizations deploying i.MX 8M Plus-based Linux devices (industrial IoT, automotive, embedded media), this is a genuine denial-of-service risk during power management transitions. For general-purpose Linux deployments on x86 or other architectures, this code path is entirely unreachable.

A local user with low-privilege access on an embedded Linux device using the NXP i.MX 8M Plus SoC (such as an industrial controller or media gateway) triggers a power management transition that causes the imx8mp-blk-ctrl driver to disable the NOC_HDCP clock. The NoC ADB400 port power-down handshake subsequently stalls indefinitely waiting for a clock that is no longer running, causing a kernel hang and complete loss of device availability. No exploit code has been publicly identified; the hang may be triggered by normal workload-driven power domain idle transitions rather than requiring adversarial input.