The flaw arises in the DRM Xe GuC driver when the asynchronous destruction of a command queue releases the device reference before the tear‑down is complete. This timing error allows the driver’s cleanup routine to drain the same workqueue while it is still active, resulting in a deadlock that freezes the kernel. The vulnerability is an internal resource‑management bug that compromises availability, not confidentiality or integrity, and requires the attacker to manipulate the GPU driver’s removal sequence.

All Linux kernel builds that contain the legacy queue‑teardown logic described in the commit history are potentially affected. No explicit version numbers are listed in the data, so any kernel earlier than the inclusion of the patched code path could be vulnerable. Systems running a GuC driver and the associated Xe workqueue infrastructure are in scope, while kernels that never load this driver are not impacted.

The CVSS score of 7.8 indicates high severity. The EPSS score is less than 1%, indicating a very low likelihood of public exploitation, and the CVE is not listed in CISA KEV. The likely attack vector is local privileged execution or an ability to influence the GPU driver’s removal sequence, as the race occurs during kernel teardown. The issue stems from a concurrency error identified as CWE‑833. An attacker with such privileges could trigger the deadlock to halt the system, a high‑severity denial‑of‑service event. Remote exploitation without local privileges is not feasible based on the description, so the overall exploitability remains low while the impact is severe.