The smscufx framebuffer driver includes an ioctl, UFX_IOCTL_REPORT_DAMAGE, that is intended to copy data from user space into kernel memory before use. Instead, the implementation references the user pointer directly. Therefore, if an attacker supplies crafted data, the kernel may perform invalid memory accesses, corrupting kernel memory. Such corruption could allow arbitrary code execution or privilege escalation from a local user.

This issue affects the Linux kernel as a whole, specifically the smscufx framebuffer driver in the fbdev subsystem. All kernel releases lacking the commit that corrects the copy operation are potentially vulnerable, regardless of distribution or patch level.

The CVSS score of 7.3 classifies the vulnerability as high severity, while an EPSS score of <1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, suggesting no public exploitation has been reported. The attack vector is most likely local; an attacker with access to the /dev/smscufx device node can invoke the ioctl and supply malicious data, potentially leading to kernel memory corruption.