The Linux kernel’s DRM/MSM driver contains a flaw in the recovery routine: a hung submit is retired before the GPU has finished its recovery. Retiring the submit frees buffer objects while the GPU might still be accessing them, which causes GPU page faults that can crash the GPU and ultimately lead to a kernel instability or system crash. The weakness is a use‑after‑free scenario described by CWE-826 and CWE-416, resulting in a denial of service when the driver mismanages GPU resources during recovery.

All Linux kernel releases that include the pre‑patch DRM/MSM recovery logic are affected. The vulnerability remains present in kernels that do not contain the listed patch commits (c303e1d52811de7d1bcf793560754d4df68d4a1c, dc64cf9d71428234389b635d142cb5fe07d57eab, e36284257eeca13768687bf8e52f66f8ea0e8794). Specific affected versions are not provided; the flaw exists in any kernel lacking the patch commits. Once a linux kernel version contains the fix in recover_worker(), which defers submit retirement until after GPU recovery, the flaw is mitigated. Users on patched kernels are not impacted.

The CVSS score of 5.5 indicates moderate severity, and the EPSS of <1% shows a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, suggesting no known large‑scale attacks. The attack vector is likely local or privileged; an attacker with the ability to issue DRM commands could trigger a hung submit and exploit the flaw. Successful exploitation requires intimate knowledge of the driver’s recovery flow but does not rely on remote network exposure. Given the limited exploitation data, the current risk is moderate, but local privileged users could potentially cause a denial of service.