A race condition exists between the gem_close and gem_change_handle ioctls in the Linux kernel’s DRM subsystem, where concurrent operations can result in an improper free of a GEM object or the installation of an invalid reference. The flaw arises from incorrect handling of the idr_replace function and a misidentified local variable, leading to two paths that do not correctly guard against a concurrent gem_close. This concurrency weakness (CWE‑362) could allow a privileged user or a malicious kernel module to trigger a use‑after‑free or an inconsistent state that could be leveraged for privilege escalation or denial of service. Affected systems are the Linux kernel, across all upstream releases that have not yet incorporated the final, corrected commit referenced by the available git URLs. Vendor information lists “Linux: Linux”, and no specific kernel version range is provided; therefore, any kernel lacking the latest change_handle fix remains vulnerable. The CVSS score is not provided and EPSS information is unavailable, while the vulnerability is not listed in CISA's KEV catalog. In the absence of a public exploit and given the complexity of race‑condition exploitation, the current likelihood of successful external exploitation is low to moderate, but the defect remains a high‑impact kernel bug that should be addressed promptly.

Linux kernel; all modern releases that have not yet applied the change_handle race condition fix detailed in the listed git commits.

With no documented CVSS score or EPSS data, the exact severity remains unclear, but the inherent race condition indicates a potentially critical kernel bug. Because the vulnerability is still in the process of being repaired and has no known public exploitation, the current risk is assessed as moderate, yet the exploitability is uncertain and could become higher if an unauthenticated or privileged attacker discovers a reliable trigger.