The Linux kernel DRM Xe passthrough module fails to reset the current_op counter during re‑initialisation. When a virtual machine bind operation is retried due to lock contention or OOM eviction, the same operation object is reused and current_op is incremented without reset. After enough retries the counter exceeds the allocated array size, resulting in an out‑of‑bounds write into SLUB‑poisoned memory and a subsequent use‑after‑free in xe_migrate_update_pgtables_cpu(). The effect is a kernel panic that can be triggered by a privileged local attacker with control over virtual machine binding, providing a denial‑of‑service path and potential for arbitrary code execution if the memory corruption is exploited.

All Linux kernel releases containing the DRM Xe passthrough module that do not incorporate commit 046045543e530605c441063535e7dca0075369a6 are affected. The vulnerability applies to all kernel versions across the Linux distribution where the xe DRM module is loaded. The required state reset is added in that commit, so any kernel updated to a release that contains it is not vulnerable.

The CVSS score is not disclosed and EPSS is unavailable, but the bug introduces classic out‑of‑bounds write and use‑after‑free conditions. The deterministic kernel crash when the retry loop is forced indicates a clear denial‑of‑service vector. Because the DRM Xe module is only accessible from privileged contexts, exploitation requires root‑level or kernel module privileges. The vulnerability is not listed in CISA KEV and no public exploits are documented, but the straightforward crash path yields a high‑impact risk for systems exposed to repeat DRM operations.