The vulnerability resides in the vmw_translate_ptr functions of the Linux kernel's drm/vmwgfx driver. The code change switched from returning a pointer to returning an error code with the pointer as an out parameter, but the error handling path was not updated. As a result, the function can return a PTR_ERR of an uninitialized pointer, causing the driver to report success when the lookup actually failed. This flaw can lead to uninitialized memory usage and out‑of‑bounds accesses inside the kernel, creating opportunities for memory corruption that could compromise confidentiality, integrity, or availability.

Any Linux system that loads the drm/vmwgfx driver is potentially affected. The kernel versions impacted are those prior to the patch that corrected the lookup return semantics; specific version ranges are not provided in the CNA data, so all earlier kernel releases are considered vulnerable.

The CVSS score of 7.8 indicates high severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need the ability to invoke the drm/vmwgfx driver’s translation functions, which typically requires local access or privilege escalation. The attack could result in arbitrary kernel memory corruption, leading to privilege escalation or denial‑of‑service.