The Linux kernel’s DRM shmem tests contain a helper, drm_gem_shmem_madvise_locked, that releases the GEM object’s reservation lock while a madvise operation is in progress. This releases the lock too early, creating a race condition that manifests as kernel warning messages and could corrupt kernel state or cause a crash. The flaw is isolated to this test helper and is not part of the public DRM driver API.

Any build of the Linux kernel that includes the unpatched drm_gem_shmem_madvise_locked helper is affected. Development and test environments that compile the original helper are impacted; production configurations that omit these test helpers are unlikely to suffer the issue.

The EPSS score is < 1% and the vulnerability is not listed in CISA KEV, indicating a very low exploitation probability. Because the flaw exists only in a test helper invoked by the Kunit test framework, the inferred attack vector requires executing that test helper in an environment where it is enabled. A successful exploitation could trigger kernel warnings, state corruption, or a crash, consistent with the moderate CVSS score of 5.5.