In the Linux kernel DRM subsystem, the change_handle function fails to nullify an old handle before swapping it during a prime operation. The flaw is a race condition classified as CWE‑416. If a concurrent gem_close removes the object, the remaining handle points to freed memory. If the kernel later dereferences this dangling pointer, a use‑after‑free occurs that can corrupt kernel memory, potentially enabling kernel crashes or privilege escalation. The flaw arises from improper synchronization between change_handle and gem_close and is similar to related race conditions addressed in other commit logs.

All systems running the Linux kernel with the DRM subsystem enabled are potentially affected. The vulnerability exists in any kernel version that has not yet incorporated the commit that nullifies the old handle (f6cd7d). Because the CPE refers to the generic Linux kernel, it applies to all mainstream Linux distributions prior to the fix.

The CVSS score is 7.8, indicating high severity, and the EPSS score is <1%, suggesting a low probability of exploitation. The likely attack vector is local access to invoke the vulnerable DRM ioctl; remote exploitation is improbable without a prior local foothold. The vulnerability is not listed in CISA KEV, meaning no publicly documented exploits yet, yet kernel corruption can lead to privilege escalation or denial of service. The risk of exploitation is therefore high for environments with unpatched kernels, especially those exposing DRM functionality to untrusted users.