The vulnerability stems from an integer overflow in the i915 DRM driver’s handling of scatterlist tables for GEM shmem objects that are 4 GB or larger. When pages allocated from a folio exhaust the unsigned int .length field, the value wraps so that the length reported to the kernel is smaller than the actual byte count. This truncation causes the driver to believe an object has fewer backing pages than it really has, potentially leading to kernel bugs such as out‑of‑bounds memory accesses, crashes, or other instability. The weakness is a classic integer overflow (CWE‑190).

All Linux kernel builds that include the i915 DRM driver and have not yet incorporated the fix commit 06249b4e691a75694c014a61708c007fb5755f60 are affected. The vulnerability is present in every kernel version compiled with i915 before the patch, regardless of distribution or release name, as the CPE indicates a Linux kernel. Users of Intel GPU platforms such as Meteor Lake running a pre‑patch kernel are at risk.

The CVSS score is not publicly disclosed, and EPSS data is unavailable, but the integer overflow directly manipulates kernel state, indicating a high severity. Exploitation requires local privilege—specifically the ability to create and map large GEM shmem objects. While the described impact is a denial of service through kernel panic or memory corruption, a successful exploitation could provide a foothold for privilege escalation if combined with other kernel weaknesses. The attack vector is inferred to be local and reliant on content crafted for the GPU driver, as no remote exploitation path is documented.