The fix in the kernel source demonstrates that a buffer object, when left in the TTM_PL_SYSTEM plane, is inadvertently treated as a fully initialized Nouveau memory structure. This misinterpretation causes a read beyond the allocated resource, a slab use‑after‑free that is reported by KASAN. The corrupted read can corrupt kernel memory. If an attacker can trigger the fault, they could achieve arbitrary code execution in kernel mode or elevate privileges. Based on the description, it is inferred that the vulnerability arises when user or kernel code interacts with the Nouveau driver and a buffer remains in TTM_PL_SYSTEM.

All Linux kernel releases prior to the commit that introduced the fix are affected. The issue was observed in a 7.2.0 kernel running on a system with a Nouveau graphics device; any distribution that ships an unpatched kernel and uses the open‑source NVIDIA driver (nouveau) is at risk. The vulnerability applies to any host where a local user or process can trigger graphics operations that involve Nouveau buffer objects.

The CVSS and EPSS scores are not publicly available, and the vulnerability is not listed in the CISA KEV catalog. However, the bug follows a classic kernel use‑after‑free pattern that can be triggered by any user with the ability to load or interact with the Nouveau driver. Because the fault occurs in kernel context, the likelihood of successful exploitation is high in environments where users have local kernel access or where the system is exposed to untrusted graphics workload. The risk is elevated for shared or multi‑tenant systems that allow local users to load graphics modules.