The flaw resides in the DRM subsystem’s drm_gem_change_handle_ioctl() function. GEM object handles are 32‑bit unsigned values exposed to userspace, but the kernel maps them to signed int indices via idr_alloc(). When a handle greater than the maximum value of a signed int is supplied, the code triggers WARN_ON_ONCE, logging a kernel warning. The description does not claim any denial‑of‑service or compromise of confidentiality or integrity; it only indicates that an attacker can force kernel log entries to be produced.

The vulnerability exists in the Linux 6.19 release candidates from rc1 through rc7, where the problematic idr_alloc() usage is part of the DRM GEM handling logic. The issue is tied to the kernel’s handling of Graphics Execution Manager (GEM) objects and the DRM device interface.

The CVSS score of 5.5 signals a moderate severity, and the EPSS score indicates a low exploitation probability (< 1%). The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local user access to the DRM device; an attacker with such access can invoke the ioctl and supply an out‑of‑range handle to cause the warning. No active exploits have been reported.