The vulnerability occurs in the Linux kernel DRM Xe queue initialization path where a missing finalization call causes a dangling queue reference that is later dereferenced during lookup. This results in an invalid memory reference that can lead to kernel memory corruption, potentially enabling an attacker with local access to trigger privilege escalation or a denial‑of‑service by crashing the system. The weakness correlates with CWE‑772 – missing release of resource.

The defect is present in the Linux kernel’s DRM Xe module. No specific kernel release numbers are listed, so any Linux kernel build that includes the xe/queue code without the required fini call is potentially affected. Systems running kernel versions prior to the patch commit are at risk.

The CVSS score of 7.8 signals high severity, but the EPSS score of less than 1% indicates that exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. The attack is most likely local, targeting the graphics subsystem; a local attacker could trigger the fault and achieve privilege escalation or a crash, although no public exploits have been reported yet.