The Linux kernel DRM Exynos vidi module implements a flaw in vidi_connection_ioctl() where a user‑supplied pointer is dereferenced directly without validation. This allows a malicious user process to read arbitrary kernel memory, potentially disclosing secrets or enabling privilege escalation. The weakness arises from improper use of untrusted data in kernel space and from accessing user memory without proper copying, fitting the definition of an improper validation of user data used in a privileged context (CWE-788) as well as an unsafe pointer usage flaw (CWE-822).

Linux systems that include the Exynos DRM vidi driver and are running kernel versions that contain the unpatched code path are affected. No specific kernel version list is provided, so any release that implements the vulnerable vidi module without the fix could be compromised.

The attack vector originates in user space via the vidi_connection_ioctl call. The CVSS score of 7.1 indicates a high severity vulnerability, while the EPSS score of < 1% suggests low likelihood of exploitation at present; the vulnerability is not listed in the CISA KEV catalog. The ability to dereference user pointers leads to a high‑impact kernel memory read, and an attacker could craft a malicious ioctl payload to read arbitrary kernel memory, potentially revealing sensitive kernel information.