The vulnerability arises from mixing devm and drmm allocation functions in the msm display driver writeback initialization. When a userspace process retains a reference to a DRM device while the driver is torn down, the kernel frees the WB connector memory using devm_kzalloc, leaving userspace interactions with the connector to dereference invalid kernel memory. This use‑after‑free (CWE‑825) can cause a kernel crash or privilege escalation.

Affected systems are Linux kernel implementations that include the DRM/msm/dpu driver. No specific kernel version range is listed, so all modern kernels using this driver are potentially impacted until the patch that replaces devm allocations with drmm allocations in dpu_writeback_init is deployed.

The CVSS score of 7.8 classifies the vulnerability as high. The EPSS score indicates a very low probability of exploitation. The vulnerability is not currently in CISA KEV. Because the issue is local to the kernel driver and requires a userspace process to hold a reference to the DRM device, the attack vector is likely privileged or local. Exploitation would probably result in kernel denial of service or privilege escalation if attacker gains control of kernel memory.