In the Linux kernel, a race condition was discovered in the DRM bridge subsystem. The function drm_bridge_add() removed a bridge from the lingering list without holding the protective bridge_lock. Both the active bridge list and the lingering list are shared between drm_bridge_remove(), __drm_bridge_free(), and the debugfs interface, all of which can be accessed concurrently. Removing a list entry outside of the lock violates the intended synchronization and can corrupt either or both lists, causing undefined behavior such as a kernel crash or corruption of kernel memory.

Any Linux kernel build that includes the buggy DRM bridge code is affected. The patch that fixes the issue is present in the kernel commit b62e3db8; any kernel version prior to incorporation of that commit is vulnerable. Users of custom kernel builds or older stable releases that have not applied the commit should verify whether they include the fix.

Based on the description, exploitation would require a local user with elevated privileges to trigger drm_bridge_add() concurrently with other kernel operations that manipulate the bridge lists, as the race condition is activated by concurrent access. No public exploit has been disclosed yet, and the EPSS score is available and less than 1%, indicating a very low probability of exploitation. The CVSS score of 4.1 indicates moderate severity. The vulnerability is not listed in the CISA KEV catalog. Consequently, the overall risk is moderate, but patching remains recommended for systems that use DRM bridge functionality, especially if the feature is active or the kernel version is before the commit.