In the Linux kernel, the rocket graphics acceleration driver contains a use‑after‑free flaw that arises when a GEM handle is inserted into the IDR before all resources are successfully allocated. If allocation or mapping fails after the handle is live, the handle is freed while still referenced, leaving a dangling reference. Later ioctl requests that look up the handle dereference freed memory, which can cause kernel crashes or allow execution of arbitrary code. This weakness is classified as CWE‑825.

All Linux distributions that ship the rocket driver in the kernel before the patch are affected. The vulnerability exists in any kernel version where the driver has not been updated to perform handle creation only after all operations succeed.

The CVSS score of 7.8 indicates a high severity, the EPSS score of < 1% suggests a low exploitation likelihood, and the flaw is not listed in the CISA KEV catalog. According to the description, the flaw is triggered by an ioctl sequence that results in a failed buffer‑creation and subsequent lookup of the freed GEM handle. The requirement of local interaction with the DRM device is not explicitly stated but can be inferred from the need to invoke the ioctl. After the patch, the handle creation order is corrected, removing the dangling reference and thereby preventing exploitation via this path.