The Linux kernel's drm/ioc32 compatibility ioctl path allows a user‑controlled pointer to be speculatively dereferenced into a table of function pointers, creating a Spectre‑type side‑channel that could potentially expose sensitive kernel data, an effect inferred from Spectre‑style vulnerabilities but not explicitly confirmed by the CVE description.

All Linux kernels that include the drm/ioc32 component and predates the commit adding array_index_nospec are affected, regardless of distribution; the vulnerability affects any vendor that delivers the vanilla Linux kernel with DRM compatibility enabled.

With a CVSS score of 5.5 the issue is classified as medium risk, but an EPSS score of <1 % and its absence from the CISA KEV catalog suggest a low probability of exploitation; attackers would need to manipulate speculative execution via the DRM ioctl interface, a complex local‑user vector that could potentially leak privileged data, an effect inferred but not confirmed.