A flaw in the Linux DRM Xe kernel module’s page fault handler allows write or atomic accesses to virtual memory areas that are marked read‑only. If an attacker can trigger a page fault on such an area, the kernel will attempt to write to memory that should be protected, potentially corrupting kernel data structures. This could enable a local attacker to gain elevated privileges or execute arbitrary code at privileged kernel level. The weakness arises from missing access control during VMA handling.

Linux kernel versions that have not incorporated the patch adding a write‑guard in xe_pagefault_service are affected. The vulnerability is present in any kernel build compiled before the change referenced in the commit log. The affected builds include the generic Linux kernel, with the fix available in later releases such as those that include commit 714ee6754ac5fa3dc078856a196a6b124cd797a0.

The CVSS base score of 5.5 indicates moderate severity. The EPSS score is reported as less than 1 %, implying a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, so no active exploits are known. Based on the description, the attack requires a local attacker who has access to the DRM Xe device to provoke a page fault on a read‑only VMA, making the attack vector local rather than remote. With this attack vector, a successful exploit could corrupt kernel memory and lead to privilege escalation.