The vulnerability involves the DRM Xe passthrough module in the Linux kernel. The xe_pt_update_ops_init() function fails to reset the current_op counter to zero during initialization. When a virtual machine bind operation is retried because of lock contention or an out‑of‑memory eviction, xe_pt_update_ops_prepare() is invoked again on the same vops, and bind_op_prepare() increments current_op without clearing it. After enough retries, current_op grows beyond the size of the array allocated by xe_vma_ops_alloc(), producing an out‑of‑bounds write into SLUB‑poisoned memory—an instance of CWE‑787—and a subsequent use‑after‑free crash in xe_migrate_update_pgtables_cpu(). The effect is a kernel panic, providing a local denial‑of‑service path; no arbitrary code execution is described by the available information.

Linux kernel releases that include the drm/xe/pt subsystem and do not contain commit 046045543e530605c441063535e7dca0075369a6 are affected. This covers all distributions that ship a kernel with the Xe DRM module enabled. The vulnerability may surface only when the module is loaded and a VM binding operation is performed repeatedly in a kernel with lock contention or OOM conditions; systems that have disabled or removed the xe DRM module are not impacted.

The CVSS score is 7.8, indicating a substantial impact. The EPSS score is below 1 %, suggesting that public exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must have privileged local access to the kernel or the ability to load kernel modules, which is typically restricted to root. The primary risk is a deterministic kernel crash that results in service interruption, rather than direct privilege escalation or data exfiltration.