The vulnerability exists in the DRM Xe subsystem of the Linux kernel. When a buffer object (BO) is destroyed after the device it belongs to has been unbound, code paths that normally reference device resources still attempt to dereference the device pointer. Because the pointer is NULL, a kernel crash (panic) occurs. This crash represents a loss of availability and is a classic NULL pointer dereference flaw, classified as CWE‑476.

All Linux kernel installations that compile the DRM Xe code path and may run virtual functions on Intel hardware are impacted. The mention of Intel hardware suggests the vulnerability is primarily relevant to Intel-based GPUs. The bug is triggered when driver objects are freed after the device context has been removed but the DRM structure remains active. Upstream fixes have been merged into recent releases and the erratum is documented in recent kernel commits.

Based on the description, the crash can be triggered by a privileged local attacker who can manipulate buffer lifecycles; thus the likely attack vector is local or requires local privilege. The CVSS score of 7.8 indicates high severity while the EPSS score of < 1 % indicates a low probability of exploitation. The flaw is not listed in the CISA KEV catalog. Remote exploitation is infeasible because the vulnerability causes a crash rather than data exfiltration. Because the outcome is a denial‑of‑service, an adversary would aim to disrupt availability, not extract information.