The Linux kernel drm/amdgpu subsystem had a vulnerability where drm_exec_fini() was called twice on the same exec object if amdgpu_ttm_tt_get_user_pages() failed during user queue validation when new_addition is true. Since drm_exec_fini() frees exec->objects and finalizes the ww acquire context and is not idempotent, this double call could cause resource corruption or instability. The error path was corrected to route directly to range cleanup after the first drm_exec_fini() call. This fix was introduced in kernel versions 7.0.0-28.28 and later. The vulnerability was discovered using a prototype static analysis tool and confirmed by code review.

If exploited, this vulnerability could lead to corruption of kernel resources or cause privilege escalation due to improper handling of GPU command execution contexts. The CVSS score of 7.8 indicates high impact on confidentiality, integrity, and availability. However, no known exploits are reported in the wild. The flaw affects local users with limited privileges (PR:L) and requires no user interaction (UI:N).

A patch is available and should be applied promptly. The vendor advisory from Ubuntu confirms that the issue is fixed in Linux kernel versions 7.0.0-28.28 and later. Users should update their systems to the fixed kernel versions listed in the advisory and reboot to apply changes. Due to ABI changes, recompilation and reinstallation of third-party kernel modules may be necessary. No additional mitigations are indicated.