Linux i915 PTE Use-After-Free

i915 code in Linux has an out-of-bounds PTE write in vmfaultgtt that leads to a PTE use-after-free condition. I found a bug in the i915 code that allows a process with access to a render node /dev/dri/renderD128 to corrupt kernel memory. This bug is subject to a 90-day disclosure deadline. If a f...