During virtio GPU resource creation, the driver frees a GEM object with a bare kfree call without first releasing the object via drm_gem_object_release. The freed object remains in an interval tree data structure, so subsequent lookup or insertion operations can walk freed memory. This use‑after‑free can corrupt kernel memory and potentially allow an attacker to trigger a crash or execute arbitrary code in kernel mode, leading to loss of confidentiality, integrity, and availability.

The vulnerability is present in the Linux kernel’s virtio GPU driver (drm/virtio). No specific kernel version is listed, so any kernel containing the unpatched virtio_gpu_vram_create path is potentially affected. The issue arises in any environment that uses the virtio GPU interface, such as virtual machines or container runtimes that expose the virtio GPU device to guest workloads.

The CVSS score is not listed, and EPSS data is unavailable, but the fault occurs in kernel space and requires the attacker to trigger a virtio GPU operation. An attacker with local or privileged guest access to the driver could exploit the use‑after‑free to corrupt memory, which could lead to a denial‑of‑service or, in the presence of additional code‑execution primitives, to runaway kernel execution. The vulnerability is not listed in CISA’s KEV catalog, but it represents a classic kernel memory corruption flaw with high potential impact if exploited.