The Linux kernel DRM subsystem contains a flaw where a pre‑locked object is prematurely added to the array of locked objects while a reference to it is still active. If that object is destroyed during this period, the kernel may later attempt to operate on a freed area, triggering memory corruption or a BUG_ON in the driver when it adds a fence to the object. This vulnerability is an instance of CWE‑416: Use After Free. The commit that resolves the issue keeps the pre‑locked object out of the locked array until the driver explicitly references it again.

All Linux kernel releases that include the vulnerable DRM implementation are affected, and no specific version range is provided. Until a patch containing the fix is installed, any system running a kernel built before the change is potentially vulnerable.

A CVSS score and EPSS figure are not supplied, and the vulnerability is not listed in CISA KEV, so the exploitation probability is uncertain. However, because the failure can corrupt kernel memory and enable arbitrary execution in kernel mode, a local adversary able to trigger contention in DRM drivers could potentially exploit it. The attack vector is not described in the advisory; it would likely involve interactions with graphics drivers that exercise the contested locking path.