The issue arises during allocation and attachment of buffer objects in the Linux kernel’s DRM Xe DMA subsystem. An empty or prematurely freed buffer can be exposed to the invalidate_mappings callback, which may dereference a NULL or dangling pointer, triggering a crash. This results in a kernel panic that effectively denies service on the affected system.

Any Linux distribution that includes the buggy drm/xe/dma-buf code before the commit that reorders the allocation and attachment logic. Systems using a kernel with this code and interacting with the DRM Xe module or drivers such as amdgpu are at risk.

The CVSS score of 7.8 indicates a high severity, while the EPSS score of 0.00139 shows an extremely low likelihood of exploitation in the near term. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack likely requires manipulation of GPU drivers or triggering a race condition in the kernel, which would most directly affect a local user or a privileged process that can influence the GPU driver. No remote exploitation path is documented, and the primary impact is a kernel crash leading to denial of service.