The vulnerability is a use-after-free (CWE-825) in the Linux kernel’s host1x GPU driver. When a buffer object is un-pinned, the driver frees the mapping and later dereferences a stale pointer, which can corrupt kernel memory. This kernel-level memory corruption could allow a local attacker to manipulate the kernel’s execution state or gain elevated privileges, though no proven privilege escalation chain is documented.

The flaw resides in the host1x driver of the Linux kernel. All Linux kernel releases that include the unpatched driver are vulnerable. Distributions shipping a kernel before the patch, regardless of vendor, are affected. The vulnerability is present in any system that loads or interacts with the host1x GPU subsystem, such as those using the driver for graphics or compute workloads.

The CVSS score of 7.8 indicates high severity, while the EPSS score of <1% shows a low probability of current exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would likely require local privileges or the ability to load or use the host1x driver; no public exploit is known. The overall risk to systems remains moderate from a threat perspective.