The vulnerability involves a double invocation of drm_exec_fini() in the amdgpu driver during user queue validation when a specific error path is taken. drm_exec_fini() frees resources and finalizes contexts but is not safe to call twice on the same exec object. The flaw occurs if amdgpu_ttm_tt_get_user_pages() fails after drm_exec_fini() has already been called, leading to a second call on the same object. This can cause use-after-free or other memory corruption issues in the kernel. The issue was discovered using a prototype static analysis tool and confirmed by code review. It affects Linux kernel versions before 7.0.0-28.28.1 in Ubuntu HWE edge kernels.

Successful exploitation could lead to kernel memory corruption, causing system instability, crashes, or potential privilege escalation due to improper resource management in the amdgpu driver. The vulnerability impacts confidentiality, integrity, and availability of the affected system as indicated by the CVSS vector (C:H/I:H/A:H).

A fix for this vulnerability is available in Linux kernel versions 7.0.0-28.28.1 and later. Users should update to this or a newer kernel version to remediate the issue. No additional mitigation steps are indicated beyond applying the official patch.