A race condition exists between the heartbeat worker and the engine retirement process in the Intel i915 driver. When the heartbeat worker frees the heart‑beat systole request and clears its pointer separately from the atomic reference count decrement, a concurrent retirement can trigger a second put on the same stale pointer. This double release causes a refcount underflow, which may lead to kernel memory corruption, system crash, or the opportunity for an attacker to gain higher privileges. The vulnerability is a classic use‑after‑free and refcount underflow abuse (CWE‑191, CWE‑911).

The flaw exists in the Linux kernel DRM subsystem for Intel graphics. Affected releases include Linux kernel 5.5 and all 7.0 release candidates (rc1 through rc7). It applies to any system running these kernel versions with the Intel i915 driver enabled, regardless of distribution.

The CVSS score of 7.8 classifies the issue as high severity. The EPSS score is below 1%, indicating a low probability of exploitation in the near term, and the flaw is not currently listed in CISA’s KEV catalog. The likely attack vector requires a local privileged user who can influence kernel scheduling and run workloads that trigger the heartbeat and retirement race. While the primary observable effect is a kernel panic, a skilled attacker could potentially exploit the memory corruption to execute arbitrary code at kernel level.