The vulnerability arises in the Nouveau driver where a 32‑bit relocation offset is added to a constant and then compared against a 64‑bit buffer size. Because the addition is performed in 32‑bit arithmetic, the result can wrap around and become smaller than the actual buffer size, letting an out‑of‑bounds relocation be considered valid. This flaw can corrupt memory and the potential for arbitrary code execution is inferred due to the memory corruption. The weakness is an integer overflow with bounds‑check bypass, classified as CWE‑190.

All Linux kernel releases that include the Nouveau driver before the upstream commit that casts the addition to 64‑bit arithmetic are potentially vulnerable. The advisory does not list specific kernel versions, so any unpatched kernel lacking that commit remains at risk until the patch is applied.

The advisory lists a CVSS score of 7.8, indicating high severity, while the EPSS score is < 1%, suggesting a low exploitation probability. CISA’s KEV catalog does not list this vulnerability. It is inferred that exploitation would likely require an attacker to control the GPU push‑buffer with crafted relocation data; such a scenario generally needs local or privileged access. The likely impact is memory corruption that could compromise integrity and availability, and in the worst case could enable arbitrary code execution. Thus far, no public exploit has been disclosed.