A logical error was introduced in the DRM subsystem of the Linux kernel. The bug causes a newly generated IDR object pointer to fail to replace the original ID's pointer in the change handle logic, leaving the old pointer in place. This leaves the kernel with an invalid or stale pointer that can be dereferenced, potentially resulting in memory corruption, a kernel panic, or even privilege escalation if an attacker can manipulate the affected DRM path.

Linux kernel versions released before the inclusion of commit 5e28b7b94408 are vulnerable. The issue arises within the DRM prime buffer management code used by graphics drivers on any Linux distribution that ships the affected kernel. No specific vendor or product version ranges were listed in the CNA data and therefore the vulnerability applies broadly to all kernels containing the unpatched DRM logic.

The CVSS score is not provided and the EPSS score is unavailable, so the exact likelihood of exploitation cannot be quantified. The vulnerability is not in the CISA KEV catalog. Based on the description, the attack likely requires a component that can interact with the DRM subsystem, such as a user‑space graphics driver or a specially crafted file descriptor. An attacker with the ability to execute code in the context of a privileged DRM client could potentially trigger the invalid pointer usage to cause a crash or escalation. The exact path for an exploit is not detailed, but the logical nature of the bug suggests that exploitation would be harder to conduct than an obvious buffer overflow.