The vulnerability arises from a use‑after‑free in the Linux kernel DRM subsystem. When drm_dev_unplug is called, framebuffer and property blob pointers that have already been freed are incorrectly dereferenced, causing kernel OOPSes and general protection faults. These crashes can bring the affected system to a state where it cannot continue to serve users or services, effectively resulting in a denial of service. The weakness is a classic use‑after‑free scenario (CWE‑416).

This issue affects all Linux kernel releases that contain the buggy DRM code and have not yet incorporated the fix. The affected product is the Linux kernel itself; any distribution shipping an unpatched kernel version may be vulnerable. No specific version numbers are listed, but the description refers to the fix being applied in a recent patch commit. Systems running recent desktop environments with GPUs that use the DRM stack are likely to experience the problem when a compositor exits or a device is unplugged.

The severity is high because a fault in the kernel can trigger a crash, though the CVSS score and EPSS probability are not publicly available. The vulnerability is present in kernel mode and does not require user input beyond normal device unplug or compositor shutdown events, so it is readily exploitable in the attack surface present on typical user machines. The vulnerability is not recorded in CISA’s KEV catalog at this time, but the lack of available score data does not diminish the risk of service disruption. An attacker could force the system to crash by manipulating device hotplug events or by causing a compositor exit in a controlled way, allowing them to achieve denial of service or potentially privilege escalation depending on kernel configuration.