The Linux DRM TTM subsystem contains a use‑after‑free flaw that occurs when a swapped‑out resource is not removed from the bulk_move list. The remaining dangling cursor can be dereferenced during later list operations, leading to list corruption or a null pointer dereference. This crash can occur minutes to hours after a hibernation cycle or at system reboot, resulting in a kernel panic. The weakness is identified as improper handling of resource eviction (CWE‑825).

All Linux kernel builds that include the DRM TTM implementation before the inclusion of the commits b2ed01e7ad3d and 1d59f36e95f7 are vulnerable. The problem was observed on an AMD Phoenix APU (ASUS UM3406GA) running Ubuntu 7.0.0‑31 during suspend‑to‑hibernate operations. The issue applies to any kernel that has the same v2.6.34‑like DRM TTM code path without the patch, regardless of vendor distribution.

The CVSS score of 7.8 indicates a high severity. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, so the probability of exploitation in the wild is low. Based on the description, the likely attack vector is local privileged access that can trigger GPU swapout operations, such as a system suspend, hibernate, or heavy GPU workload. Remote or low‑privilege exploitation appears unlikely because the flaw requires manipulating kernel‑level DRM resources. Therefore, the risk for an attacker who has local access to the machine and can control GPU activity is higher than for an attacker with only remote or low‑privilege access.