The Linux DRM GEM subsystem contains a race between the drm_gem_change_handle ioctl and a concurrent drm_gem_handle_delete. During the window between releasing and reacquiring the table lock, the old GEM object can be freed while the new handle still references it, causing a use‑after‑free condition that may corrupt kernel memory. This weakness is classified as a race condition (CWE‑362) leading to an improper use of a freed resource (CWE‑366).

All Linux kernel builds that include the DRM GEM driver are affected, including mainstream distributions that ship with the default kernel. The vulnerability was fixed by commit 0dfa42cfe4… and is present in recent stable releases; any kernel lacking this commit or a later revision is vulnerable.

The CVSS score of 8.8 marks this as a high severity issue, yet the EPSS score is below 1% indicating a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation likely requires local, privileged access to perform DRM ioctls that trigger the race condition; the attack vector is inferred to be local user or compromised process access to the DRM subsystem.