The Linux kernel’s nouveau graphics driver contains a race condition between an information‑lookup ioctl and a gem‑close operation. When an info ioctl looks up a VMA, a concurrent close can free the same VMA, triggering a use‑after‑free that corrupts kernel memory. This flaw, classified as CWE‑367, can enable an attacker to read or write arbitrary kernel data, potentially leading to privilege escalation or denial of service.

Any system running a Linux kernel that has incorporated the commit referenced in the advisory is vulnerable. This includes most Linux distributions that ship the standard kernel with nouveau enabled by default and that have not yet applied the patch to resolve the race. The vulnerability applies to both legacy and current kernel branches that contain the affected code.

The CVSS score of 7.0 indicates high severity. EPSS is < 1% and the vulnerability is not listed in CISA’s KEV catalog, suggesting no vector involves orchestrating a race between an info ioctl call and a gem‑close operation, which would typically require local code execution or the ability to trigger both calls against a running process on the same machine. Exploitation would corrupt kernel memory, enabling privilege escalation or system disruption if the race succeeds.