The vulnerability is a use‑after‑free condition in the Linux kernel’s host1x GPU driver. When the function that unpins a buffer object drops its last reference, the driver later accesses the freed mapping through a stale pointer. This can corrupt memory and, in a privileged context, allow an attacker to execute arbitrary code with kernel privileges. The flaw is a classic use‑after‑free (CWE‑416) and thus carries a very high potential impact.

The flaw exists in the Linux kernel’s host1x GPU driver across all versions in which the bug was present, before the patch was released. All distributions that ship the affected kernel, including the mainline kernel, may be affected. Affected systems are those that use the host1x GPU subsystem for rendering or compute. Vendor information is limited to Linux kernel releases; explicit affected version ranges were not provided.

The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the nature of the flaw—an unguarded kernel memory access—implies a high exploitation risk. The attack likely requires local privileges or the ability to load or interact with the host1x driver; it is inferred that an attacker could trigger the flaw by causing a host1x buffer to be cleared while still referenced. The lack of a publicly disclosed exploit reduces immediate threat, yet the high severity and the kernel context demand swift remediation.