The root cause of this vulnerability is that the
ioctl$DRM_IOCTL_MODE_DESTROY_DUMB can decrease refcount of
*drm_vgem_gem_object *(created in *vgem_gem_dumb_create*) concurrently, and
*vgem_gem_dumb_create *will access the freed drm_vgem_gem_object.

It was discovered that the virtual graphics memory manager implementation
in the Linux kernel was subject to a race condition, potentially leading to
an information leak.