The flaw occurs when the CPU job ioctl in the Linux DRM V3D driver frees the cpu_job structure before its associated timestamp and performance query arrays are released. This results in a use‑after‑free condition and, on an early initialization failure, a NULL dereference. Additionally, the manual free bypasses reference release of synchronization objects, causing a leak. The weakness is classified as CWE‑825.

All systems running a Linux kernel that incorporates the drm/v3d driver and whose kernel code has not yet been updated to the commit that unifies CPU job teardown are potentially affected. This includes community builds as well as vendor‑supplied kernels lacking the patch.

The CVSS score of 7.8 signifies high severity, yet the EPSS score is below 1 %, indicating a very low likelihood of exploitation in production environments. The flaw is not present in the CISA KEV catalog. The likely attack vector is a local privileged invocation of the vulnerable ioctl interface; this inference is based on the nature of kernel device drivers. Successful exploitation could corrupt kernel memory, potentially causing a crash or providing a foothold for privilege escalation if combined with other local weaknesses.