The Linux kernel’s DRM Intel i915 graphics driver contains a null pointer dereference that is triggered when an IOCTL command causes a scheduling engine allocation to fail. The flaw arises because the context teardown function intel_context_put() is called before the context initialization function intel_context_init() within execlists_create_virtual(), causing kref_put() to dereference a null reference. The resulting kernel panic destroys system availability and allows a local user to cause a denial of service by invoking the vulnerable IOCTL. This weakness is a classic null dereference, identified as CWE‑476.

Any Linux kernel build that contains the Intel i915 graphics driver and predates commit 4f2a12f2d50e9f48227656e4dcbd6423506be31d is potentially vulnerable. All current kernel releases that have not incorporated this change remain at risk.

The CVSS score is 5.5 and the EPSS score is < 1%, indicating a low to moderate risk potential. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the attack vector is local, requiring the execution of a specific IOCTL and knowledge of the GPU driver internals. The likelihood of exploitation is considered low to moderate, but a successful exploit would result in a kernel panic, causing a denial of service.