The flaw is a use‑after‑free caused by a race condition between FD_ADD() and close() in the dma_buf_fd tracepoint. When a file descriptor becomes live, a concurrent close can free the underlying dmabuf before the tracepoint runs, leading to a dereference of a freed object and potential kernel memory corruption. This slab‑use‑after‑free can overwrite critical kernel data structures, possibly enabling an attacker to execute arbitrary code with elevated privileges or crash the system.

All Linux kernel releases that have not applied the patches in commits b569f86e2f8dbf6f11d31d3de794d22e18098b23 and ead6680f354f83966c796fc7f9463a3171789616 are affected. In practice this includes any kernel version prior to the application of these commits, regardless of distribution vendor.

The CVSS score of 7.8 classifies this as high severity. The EPSS score of less than 1% indicates a low probability of automated exploitation at the time of analysis, and it is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attacker must be local and able to orchestrate a race between FD_ADD and close on a shared file descriptor table. While exploitation is challenging, skilled attackers could potentially trigger the race to achieve denial of service or privilege escalation.