In the Linux kernel DRM GEM subsystem, a concurrent drm_gem_handle_delete can free a GEM object while an earlier drm_gem_change_handle ioctl holds a reference to it. The freed object is nulled, creating a use‑after‑free scenario that can corrupt kernel memory. The weakness is a (CWE‑366).

Affected systems are any Linux kernel builds that include the DRM GEM subsystem, including all mainstream distributions that ship with the default kernel. No specific version list is provided in the CWE data, but the fix was introduced in the kernel commit 0dfa42cfe4... and references show the patch applied in recent stable releases. Systems must be running a kernel that contains this patch or a later revision.

The CVSS score of 8.8 indicates high severity, but the EPSS score is less than 1%. The vulnerability is not listed in CISA's KEV catalog. Attackers would need local, privileged access to issue DRM ioctls that trigger the race. Based on the description, it is inferred that the exploit requires a user scheduled operations on the same GEM object to overlap; thus, the attack likely originates from a local privileged or compromised user.