In the Linux kernel DRM subsystem, the change_handle function fails to nullify an old handle before swapping it during a prime operation. If a concurrent gem_close removes the object, the remaining handle points to freed memory. If the kernel later dereferences this dangling pointer, a use‑after‑free occurs that can corrupt kernel memory, potentially enabling arbitrary code execution or a kernel crash. The flaw arises from improper synchronization between change_handle and gem_close and is analogous to related race conditions addressed in other commit logs.

All systems running the Linux kernel with the DRM subsystem enabled are potentially affected. The vulnerability exists in any kernel version that has not yet incorporated the commit that nullifies the old handle (f6cd7d). Because the CPE refers to the generic Linux kernel, it applies to all mainstream Linux distributions prior to the fix.

The CVSS score is not provided and EPSS is unavailable, but the nature of a use‑after‑free in kernel space indicates high severity. Attackers would need local access to trigger the vulnerable DRM ioctl; remote exploitation is unlikely without prior local foothold. The vulnerability is not listed in CISA KEV, meaning no publicly documented exploits yet, yet kernel corruption can lead to privilege escalation or denial of service. The risk of exploitation is therefore high for environments with unpatched kernels, especially those exposing DRM functionality to untrusted users.