In the Linux kernel’s DRM XE driver, a use‑after‑free bug was introduced when xe_sriov_pf_migration_restore_produce() returned an error without nulling the data pointer. Subsequent .write() invocations could dereference freed memory, leading to a kernel crash, service disruption, or potentially compromise control of the kernel.

Linux kernels built before the inclusion of commit 4f53d8c6, which nulls the pointer on error, are vulnerable. Any distribution whose kernel version predates this commit remains affected until the patch is applied.

The CVSS score of 7.8 indicates high severity. The EPSS score is less than 1%, showing a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation would require triggering the buggy write sequence after a migration restore failure, which typically demands local or privileged access. The potential for denial of service and, if the attacker can influence the write path, code execution is also inferred.