The Linux kernel's drm/xe/dma-buf subsystem contained a use-after-free vulnerability caused by a retry loop that failed to handle errors properly. When an error occurred, the buffer object was freed, but the retry loop would still attempt to use it, resulting in a UAF condition. The patch changed the code to allocate and initialize the buffer object as a single unit before attaching it, ensuring the retry mechanism is safe and does not lead to UAF. This vulnerability was reported by Sashiko and fixed in Linux kernel versions 7.0.0-28.28.1 and later.

Successful exploitation of this vulnerability could lead to a use-after-free condition, which may allow an attacker with local privileges to cause memory corruption. This can result in confidentiality, integrity, and availability impacts including potential privilege escalation or system crashes. The CVSS vector indicates low attack complexity and privileges required, with high impact on confidentiality, integrity, and availability.

A fix is available and included in Linux kernel versions 7.0.0-28.28.1 and later. Users and administrators should update affected Linux kernel versions to 7.0.0-28.28.1 or newer to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.