The vulnerability resides in the vmw_translate_ptr functions of the Linux kernel’s drm/vmwgfx driver. A change in the lookup function swapped a pointer return for an error code with the pointer passed as an out parameter, yet the error handling code was not updated. Consequently, on lookup failure the functions return a PTR_ERR value derived from an uninitialized pointer, causing the driver to report success when the lookup actually failed. This flaw can lead to uninitialized memory usage and out‑of‑bounds accesses inside the kernel, creating opportunities for memory corruption that could compromise confidentiality, integrity, or availability.

Any Linux system that loads the drm/vmwgfx driver is potentially affected. The kernel versions impacted are those prior to the patch that corrected the lookup return semantics; specific version ranges are not provided in the CNA data, so all earlier kernel releases are considered vulnerable.

The CVSS score of 7.8 indicates high severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need the ability to invoke the drm/vmwgfx driver’s translation functions, which typically requires local access or privilege escalation. The attack could result in arbitrary kernel memory corruption, leading to privilege escalation or denial‑of‑service.