The vulnerability in the Linux kernel's DRM subsystem was due to a race condition in the change_handle ioctl operation. During a prime handle swap, a single object could temporarily have two idr entries. If a concurrent gem_close operation deleted the object and removed one handle while leaving the other dangling, it could lead to a use-after-free when the dangling handle was dereferenced. The fix involved setting the old handle to NULL before swapping handles and ensuring proper reference release, similar to the approach used in gem_close. Additionally, a similar race condition in drm_gem_handle_create_tail was fixed by allocating the new handle with NULL and swapping in the correct object later. These changes prevent the race conditions by holding the prime lock during the entire operation and carefully managing handle references.

Successful exploitation of this vulnerability could lead to use-after-free conditions in the DRM subsystem, potentially allowing an attacker with local access and low privileges to cause memory corruption. This could result in confidentiality, integrity, and availability impacts (C:H/I:H/A:H) on affected systems running vulnerable Linux kernel versions.

A fix is available in Linux kernel versions 7.0.0-28.28.1 and later. Users should upgrade to these or later kernel versions to remediate the vulnerability. Since this is a kernel-level issue, applying the official kernel update from the vendor is the recommended mitigation.