The Exynos DRM driver in the Linux kernel contains an error in vidi_connection_ioctl where the driver data is incorrectly taken from the master DRM device instead of the specific vidi component. This mis‑lookup can trigger null pointer dereferences, out‑of‑bounds memory accesses, and use‑after‑free conditions (CWE‑416, CWE‑466). These bugs can corrupt kernel memory and potentially cause system crashes or other instability. While the CVE description does not explicitly state privilege escalation, kernel memory corruption could enable such an outcome if successfully exploited.

Any Linux kernel that includes the Exynos DRM subsystem and has not applied the upstream fix that replaces the lookup with priv->vidi_dev is affected. This includes all kernels running on Exynos SoCs before the patch, such as many Android devices and embedded boards that use the Exynos DRM driver.

The CVSS score of 7.8 reflects high severity, with the primary fallout being kernel memory corruption and denial of service. The EPSS score of <1% indicates a very low likelihood of exploitation in broad deployments, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require local access to the vidi ioctl interface, as the flaw stems from an internal lookup bug. While the entry does not identify a specific attack vector, the most plausible approach involves a local attacker invoking the vulnerable ioctl to trigger the memory corruption.