A race condition vulnerability in the Linux kernel PowerVR GPU driver allows local attackers to trigger a NULL pointer dereference, posing a risk of system crashes or privilege escalation.

The vulnerability exists due to improper locking in the drm/imagination driver, where a map operation can occur simultaneously with a find operation. This race condition leads to a NULL pointer dereference, which requires a local attacker with low privileges to trigger.

The vulnerability carries a CVSS score of 7.8, reflecting its high impact on system integrity, availability, and confidentiality. While the attack requires local access, a successful exploit could lead to full system compromise or denial of service, impacting the reliability of production environments relying on the affected hardware and kernel configuration.

Immediate Action: Update the Linux kernel to version 6.12.101, 6.18.42, 7.1.6, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or panic messages associated with the PowerVR GPU driver or drm_gpuvm operations, which may indicate attempted exploitation.

Compensating Controls: Restrict access to the system for untrusted local users to prevent the execution of malicious code that could trigger the race condition.

Public Exploit Available: No

Organizations utilizing affected Linux kernel versions should prioritize patching to the specified stable releases. Given the potential for privilege escalation and system instability, applying the kernel update is the only definitive way to resolve the underlying race condition and secure the environment against local exploitation.