The Linux kernel DRM Exynos vidi module implements a flaw in vidi_connection_ioctl() where a user‑supplied pointer is dereferenced directly without validation. This oversight allows a malicious user process to read arbitrary kernel memory, potentially disclosing secrets or enabling privilege escalation. The weakness arises from improper use of untrusted data in kernel space, fitting the definition of an improper validation of user data used in a privileged context.

Linux systems that include the Exynos DRM vidi driver and are running kernel versions that contain the unpatched code path are affected. No specific kernel version list is provided, so any release that implements the vulnerable vidi module without the fix could be compromised.

The attack vector originates in user space via the vidi_connection_ioctl call. Although no CVSS score or EPSS value is available and the vulnerability is not listed in the CISA KEV catalog, the ability to dereference user pointers leads to a high‑impact kernel memory read. Exploit construction would involve crafting a malicious ioctl payload that forces the kernel to read data from a chosen address, potentially revealing sensitive kernel information.