The Linux kernel’s DRM/xe subsystem protects the Global Graphics Translation Table (GGTT) MMIO region only when a driver successfully loads. If the driver load fails, the protection is not applied, allowing an attacker to access the GGTT MMIO region and potentially read or write arbitrary kernel memory. This weakness is a race condition vulnerability (CWE-1220) that can lead to kernel memory corruption and privilege escalation.

All Linux kernels that include the DRM/xe subsystem and have not integrated the commit introducing the open‑coded protection flag are affected. The affected products include any distribution that ships a Linux kernel version predating the fix (the patch is present in kernel releases that include commit 4f3a998a173b4325c2efd90bdadc6ccd3ad9a431). Vendors should verify whether their kernel version contains this protection.

The CVSS base score of 7.8 reflects high severity. The EPSS score is less than 1%, indicating a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the likely attack vector requires local privileged access that can trigger a driver load failure or manipulate buffer objects to keep the GGTT MMIO region pinned when the driver is torn down. Exploitation would therefore entail local privilege escalation or an existing high-privilege foothold, compromising system integrity and availability.