During the pinning and unpinning process of display buffers in the Linux kernel's DRM/xe driver, a faulty list removal logic caused a buffer object to remain in the pinned list after its reference count dropped to zero. When that object was freed, the lingering list entry pointed to deallocated memory, corrupting the list structure and creating a use‑after‑free condition. The flaw can lead to memory corruption, which an attacker with sufficient privileges could exploit to execute arbitrary code or cause a denial of service.

All unpatched Linux kernel releases that include the xe DRM driver before the patch identified in the commit sequence are affected. The CNA vendor/product list indicates that the target is the Linux kernel (Linux:Linux), but specific version numbers are not provided, so any system running an unpatched kernel containing these functions is at risk. This assessment is inferred from the available vendor and product information.

The EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog, but the flaw’s nature—list corruption leading to a use‑after‑free—provides a theoretical pathway for privilege escalation in a local or remote exploitation scenario. The absence of exploitation evidence does not diminish the potential impact; attackers may develop techniques to trigger the memory corruption. The risk is considered moderate until verification or a proof‑of‑concept demonstrates active exploitation. The likely attack vector is local, requiring kernel‑level access, but can also be leveraged in privileged process contexts or through compromised drivers. The CVSS score of 7.8 indicates high severity.