The vulnerability resides in the Linux kernel’s DRM GPU virtual memory management where the mapping operation does not acquire the proper lock before performing mapping. This race condition allows a concurrent find operation to dereference a NULL pointer, causing a kernel panic and loss of service. The crash lacks additional privilege escalation or data exfiltration, but it results in denial of service and potential interruption of any applications relying on the affected GPU driver.

The flaw exists in the generic Linux kernel GPU virtual memory subsystem, affecting all distributions and vendor kernels that ship the unpatched drm_gpuva_find implementation. It is exploited through the PowervR driver’s map/unmap ioctl paths. No specific kernel releases are listed, so any running kernel that has not applied the latest upstream patch is potentially vulnerable.

The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. Because the fault can be triggered by user‑space IOCTL calls, a local attacker with access to the DRM device can induce the crash. The CVSS score is 7.8, which represents high severity for a kernel panic that causes denial of service. The likely attack vector is local through GPU device IOCTLs, with the condition that a mapping operation occurs while a find is in flight.