A flaw in the Linux kernel’s DMA fence implementation allows the ops pointer to be cleared after a fence is signaled without sufficient RCU protection, which can lead to a use‑after‑free or NULL pointer dereference when the ops pointer is accessed. The vulnerability resides in the kernel’s handling of DMA fence objects and can compromise kernel integrity if triggered by a DMA fence operation. The root cause is the improper check that tests the ops pointer instead of the signalling bit, allowing the ops pointer to be cleared prematurely for many implementations.

All Linux kernel binaries that employ the default DMA fence implementation prior to the patch are potentially affected. No specific version numbers are listed in the advisory, so any kernel build using the relevant dma‑buf/dma‑fence code before the latest change is susceptible.

The EPSS score is < 1% and KEV is not listed; a CVSS score of 7.1 is assigned. The vulnerability can result in a kernel use‑after‑free, which typically carries a high severity level. Although specific exploitation probability metrics are absent, the theoretical impact remains significant if the flaw is triggered during DMA fence handling. The patch restores RCU protection and prevents the use‑after‑free condition.