Linux Kernel EUVD-2026-28564

Exploitation requires: (1) A Renesas RZ/G2L or RZ/G2LC ARM64 SoC system with the affected Linux kernel version; (2) A MIPI DSI display panel that sends DSI commands in its unprepare() callback (such as ILI9881C or similar models); (3) Local system access as a standard user (PR:L, not root); (4) Ability to initiate a system reboot. The vulnerability does NOT occur during normal operation, only during system shutdown/reboot. The DSI interface must be configured and active at boot time. Default RZ/G2L systems without MIPI DSI displays or with panels that do not issue DSI commands during unprepare are NOT vulnerable. Note: The CVSS Local Attack Vector (AV:L) and Low Privilege Requirement (PR:L) mean this is not remotely exploitable, only by interactive users on the system itself.

Despite the CVSS 5.5 score (moderate severity), real-world risk is limited by multiple factors. EPSS score of 0.02% (4th percentile) indicates very low likelihood of practical exploitation, primarily because this requires local access (AV:L) with standard user privileges (PR:L), meaning only authenticated system users can trigger reboots. The vulnerability only manifests during system shutdown/reboot sequences, not during normal operation, and only affects RZ/G2L platforms with incompatible display panels - a narrow set of embedded and ARM-based devices. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires local interaction but no special configuration or privileges beyond standard user rights. While the panic completely denies service during reboot, the impact is temporary and non-persistent. The low EPSS combined with high CVSS suggests this is a device-specific stability issue rather than a widely exploitable security vulnerability; however, it remains important for RZ/G2L system maintainers and embedded Linux distributions targeting this SoC.

A local user with standard system privileges (no root required) triggers a system reboot via reboot command or systemd shutdown procedure. During the shutdown sequence, the drm_panel driver attempts to unprepare the display, which for certain panels like ILI9881C requires sending MIPI DSI commands. Since the DSI interface has already been stopped by the driver's atomic_disable callback (due to the sequencing bug), these commands target a non-functional interface, causing the hardware to raise an SError exception. The kernel panic halts the system before graceful shutdown completes. No special timing or race condition is required; the panic is deterministic for affected panel types during every reboot.