In the Linux kernel's Intel i915 DRM driver, a bug allows CRTC color blob pointers to remain non‑null after their references are released. If the same hardware state is cleared twice, the kernel attempts to drop the same references again, which can corrupt memory and may cause a kernel panic. This manifests as a denial of service and compromises system stability.

All Linux kernel releases that lack the commit that clears CRTC color blob pointers after dropping references are affected. The patch is present in kernel revisions that include commit d5005addb5f68e8a0edce249506757bdc9e3d8c8 or later. Systems running older kernels with Intel integrated graphics and performing DRM operations are therefore at risk.

This issue carries a CVSS score of 7.8 and an EPSS score of less than 1%, and it is not listed in the CISA KEV catalog, indicating a moderate severity but low likelihood of exploitation. The likely attack vector is a failure path in the DP tunnel group lookup within the Intel DRM subsystem, which may be induced by manipulating GPU workloads or triggering a DP tunnel lookup failure. If exploited, the resulting kernel crash would be severe, yet the narrow exploitation conditions suggest that local or specialized privilege escalation is needed.