The vulnerability arises from a mis‑managed lock in the Linux DRM Xe userptr module. When the CONFIG_DRM_XE_USERPTR_INVAL_INJECT option is enabled, the commit path acquires the notifier_lock for reading, but later code paths assume the lock is held for write. This incorrect assumption triggers an assertion failure that can cause a kernel panic, resulting in a denial of service. The flaw resides in improper lock usage (a race condition) and could be leveraged by anyone able to trigger the injection sequence.

All Linux kernel builds that enable the CONFIG_DRM_XE_USERPTR_INVAL_INJECT configuration are affected. Production kernels that do not enable this option remain unaffected. The issue applies to any platform running the kernel before it is patched with the commit that adds xe_pt_svm_userptr_notifier_lock() and related fixes.

The CVSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. The EPSS score is not available, so the exact likelihood of exploitation is unclear. However, the flaw can lead to a kernel panic, a high‑impact outcome. The likely attack vector is local or via privileged code that can trigger the invalidation path; a remote attacker would need significant privilege or kernel module injection to exploit it.