A Linux kernel implementation of a Graphics Device Driver (Xe) failed to validate the pat_index supplied through a madvise IOCTL before using it to index an internal array. The unchecked index allowed a crafted value to trigger an out-of-bounds read from the xe->pat.table array, potentially exposing kernel memory contents. This flaw is an instance of improper input validation and unsafe array access, leading to information disclosure in kernel space.

The vulnerability resides in the Linux kernel, affecting all kernel releases prior to the inclusion of the patch that introduces bounds checking on pat_index. No specific version range is listed in the CNA data, so any kernel build that lacks the commit 944a3329b05510d55c69c2ef455136e2fc02de29 is considered vulnerable.

Based on the description, the vulnerability requires a malicious user to interact with the drm/xe driver by sending a madvise IOCTL with a crafted pat_index value. The exact privilege level needed to perform this I/O operation is not detailed in the data and is therefore uncertain; it likely depends on device node permissions but cannot be confirmed from the provided information. The CVSS score of 7.1 signals high severity, and the EPSS score of < 1% indicates a low likelihood of exploitation. Because the vulnerability is not listed in CISA's KEV catalog it is not known to have active exploits, but the potential to read kernel memory presents a serious confidentiality risk if successfully leveraged.