The defect resides in the DRM shared‑memory test helpers of the Linux kernel, where vmap and vunmap functions are used without holding the GEM object's reservation lock. This oversight triggers kernel warning messages during unit test execution and can introduce inconsistent state if the test harness is run concurrently. The code path affected is confined to the Kunit test suite; it is not exposed through any regular driver or user‑space interface, so no direct security impact is observed for normal operation.

All Linux kernel builds that compile the drm/gem/shmem Kunit tests and contain the unpatched test helpers are affected. The vulnerability does not affect any specific kernel release or distribution but is present in any custom build that includes the legacy test helpers prior to the patch.

Because the vulnerable code is exercised only in a controlled testing environment and is not available to production drivers or users, the risk to system integrity, confidentiality, or availability is negligible. The CVSS score of 5.5 indicates a moderate severity, but EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, reinforcing the low likelihood of exploitation. Updating to a kernel that incorporates the patch eliminates the warning conditions and the associated risk.