A race condition vulnerability in the Linux kernel nouveau/gem driver poses a high risk of local privilege escalation and system compromise.

This is a use-after-free vulnerability caused by a race condition between the info lookup finding a virtual memory area (VMA) and the gem close path closing the VMA. Exploitation requires a local attacker with low privileges.

Successful exploitation of this vulnerability allows a local user to gain elevated privileges or cause a kernel panic, leading to system downtime. Given the CVSS score of 7.8, this flaw represents a significant risk to the integrity and availability of Linux-based systems, particularly in multi-tenant or shared environments where local access is granted to untrusted users.

Immediate Action: Update the Linux kernel to version 6.6.157, 6.12.109, 6.18.50, 7.2.4, or newer, as specified by your distribution provider.

Proactive Monitoring: Monitor system logs for kernel oops or segmentation faults that may indicate an attempt to trigger the use-after-free condition.

Compensating Controls: Restrict access to the system for untrusted local users to minimize the exposure window while the patching process is underway.

Public Exploit Available: No (exploit_available: false)

This vulnerability presents a high risk to Linux environments due to its potential for privilege escalation. Administrators should prioritize patching the kernel to the versions listed above, as these releases contain the upstream fix for the nouveau/gem race condition. Please coordinate with your distribution maintainers to ensure the appropriate security updates are applied to your production infrastructure.