The vulnerability arises from a mis‑managed lock in the Linux DRM Xe userptr module. When the CONFIG_DRM_XE_USERPTR_INVAL_INJECT option is enabled, the commit path acquires the notifier_lock for reading, but later code paths assume the lock is held for write. This incorrect assumption triggers an assertion failure that can cause a kernel panic, resulting in a denial of service. The flaw resides in improper lock usage and could be leveraged by anyone able to trigger the injection sequence.

All Linux kernel builds that enable the CONFIG_DRM_XE_USERPTR_INVAL_INJECT configuration are affected. Production builds that do not enable this option remain unaffected. The issue applies to any platform running the kernel before it is patched with the commit that adds xe_pt_svm_userptr_notifier_lock() and related fixes.

The CVSS score of 7.8 indicates a high severity vulnerability, and the recall that it is not listed in CISA's KEV catalog means it is not currently known to be actively exploited. The EPSS score of less than 1% suggests that the probability of exploitation is low, but still non‑zero. The flaw can cause a kernel panic, delivering a denial‑of‑service impact. The likely attack vector is local or via privileged code that can trigger the invalidation path; remote exploitation would require significant privilege or kernel module injection.