The defect originates in the Linux kernel's DRM Xe virtual memory subsystem. When a VM is closed, page tables (PTs) are freed before pending VMAs are unlinked, causing a race that leads to a NULL pointer dereference in the function xe_pt_zap_ptes during a concurrent eviction. The resulting kernel panic would stop system operation, providing an attacker with a denial‑of‑service condition. This is a classic race‑condition flaw (CWE-362) that culminates in a NULL pointer dereference (CWE-476).

Any Linux kernel that contains the DRM Xe driver is potentially vulnerable; the CVE data does not specify a particular kernel version, so the risk applies to all affected builds that have not yet incorporated the fix.

Exploitation requires the attacker to simultaneously generate buffer objects that are subject to eviction while the PT destruction is pending, a scenario plausibly achievable by user‑space graphics applications or malicious code with similar permissions. The vulnerability is not listed in CISA's KEV catalog and no EPSS score is available, yet the impact of a kernel crash is severe. The combination of a high‑impact kernel panic and a non‑trivial but achievable race condition makes this a high‑severity flaw that should be addressed immediately.