A high-severity use-after-free vulnerability in the Linux kernel DRM subsystem exposes local users to potential privilege escalation and system compromise.

The vulnerability is caused by an improper call sequence in the Imagination GPU driver (drm/imagination) where drm_sched_entity_fini is invoked twice during context destruction. This flaw requires a local attacker with authenticated access to the system to trigger the race condition or memory corruption.

Successful exploitation of this vulnerability allows a local attacker to achieve elevated privileges or trigger a kernel panic, leading to unauthorized access and system downtime. With a CVSS score of 7.8, the vulnerability is classified as high severity, reflecting the significant risk of local privilege escalation and potential impact on the confidentiality, integrity, and availability of the underlying host system.

Immediate Action: Update the Linux kernel to version 6.12.101, 6.18.42, 7.1.6, or a later stable release where this issue has been resolved.

Proactive Monitoring: Monitor system logs for kernel-related warnings, specifically looking for refcount underflow errors or general protection faults that may indicate exploitation attempts.

Compensating Controls: Restrict access to sensitive hardware interfaces and ensure that only authorized users can execute code on the affected systems to minimize the local attack surface.

Public Exploit Available: Unknown

Given the potential for local privilege escalation within the kernel, this vulnerability should be prioritized for patching during the next scheduled maintenance cycle. Administrators should verify the current kernel version and apply the recommended updates to prevent potential exploitation by malicious local actors.