A dma-buf buffer that is imported as a ttm_bo_type_sg object may be freed by its exporter while the importer still holds references to the reservation object. Because the importer does not take a dma-buf reference until after dynamic attach succeeds, a temporary failure or early deletion can leave a dangling reference to the exporter’s reservation object. Accessing that reservation later triggers a kernel general protection fault, which results in a crash or reboot. The flaw is a classic use‑after‑free condition (CWE‑416).

The issue exists in any Linux kernel that contains the DRM/xe and AMDGPU drivers without the patch commit that adds a dma‑buf reference for imported BOs. Both drivers are part of the standard kernel tree, so all distributions with kernel versions prior to the fix are affected. No specific vendor or configuration is mentioned beyond the presence of these drivers; the flaw applies to all architectures supported by the DRM subsystem.

No CVSS score or EPSS value is listed; the vulnerability is not part of the CISA KEV catalog, indicating no publicly available exploitation. The flaw requires access to kernel code to create an exporter/importer dma‑buf pair that triggers a failure path, so it is limited to privileged or compromised processes. The primary risk is a denial of service via a kernel crash. Although no active exploitation has been reported, any system with the vulnerable kernel is at medium to high risk until patched.