The patch addresses a flaw in the Linux nouveau GPU driver where a region object was freed prematurely during a failed unmap operation. This premature free removes the region’s only reference, causing a use‑after‑free when the cleanup routine later attempts to drop the already‑freed object. The resulting memory corruption can lead to data corruption or, in the worst case, arbitrary code execution with kernel privileges. The weakness is a classic use‑after‑free scenario, which in kernel context can elevate an attacker’s capabilities or crash the system.

The vulnerability affects the Linux kernel’s nouveau component, a generic Linux distribution feature that supports NVIDIA GPUs. No specific kernel release numbers are provided in the data, so any kernel that contains the affected nouveau driver code before the patch is potentially impacted. Deployments that enable the nouveau driver or use GPUs with the nouveau_uvmm feature should review their kernel versions for the presence of the fix.

The CVSS score of 7.8 reflects a high severity for a kernel bug, yet the EPSS score of less than 1% suggests exploitation attempts are currently rare or not publicly observed. The vulnerability is not listed in the CISA KEV catalog and there is no evidence of a publicly available exploit. The attack requires local kernel access or the ability to trigger GPU driver operations that lead to the failure path, implying that the primary vector is local. Given the kernel context, a successful exploit could compromise the entire system, though the low EPSS indicates that in practice the risk is moderate toward high, pending a local privileged attacker.