A race condition in the Exynos Virtual Display driver results in memory allocation and deallocation operations being performed without proper lock protection. The kernel can free an object that another thread is still accessing, triggering a use‑after‑free scenario. This vulnerability can corrupt memory, potentially allowing an attacker to execute arbitrary code or crash the system. The weakness is a classic use‑after‑free flaw (CWE‑416).

Any system running a Linux kernel that incorporates the Exynos Virtual Display driver is affected. The vulnerability is present in all versions of the Linux kernel up to the point where the patch is applied, regardless of distribution vendor. The specific impacted component is the DRM/exynos vidi module; therefore all Linux kernels that compile with the Exynos Virtual Display driver are at risk.

The CVSS score of 7.8 indicates a high severity, and the EPSS score of less than 1 % suggests that exploitation is currently unlikely, consistent with the fact that the vulnerability requires a race condition. The vulnerability is not yet listed in CISA’s KEV catalog. The primary attack vector is local, requiring concurrent use of the driver by two threads, which typically means a privileged or root user or a malicious user exploiting a privileged interface. While not immediately exploitable in a publicly shared environment, an attacker with local access could trigger the flaw to corrupt memory or gain arbitrary code execution.