Linux’s DRM‑gem subsystem calculates the dimensions of sub‑sampled planes with simple integer division, while the framebuffer validation path rounds size up using DIV_ROUND_UP(). For certain pixel formats such as NV12, a framebuffer that is one pixel tall yields a height of zero in the size guard, and the expression (height‑1) wraps to the maximum unsigned int value. This wrap causes the minimum size calculation to overflow back to an extremely small value, allowing the kernel to allocate a GEM object that is far smaller than the pixel data it contains. When the GPU later accesses the chroma plane, it reads or writes memory beyond the allocated object’s bounds, corrupting kernel memory. This out‑of‑bounds access can lead directly to privilege escalation or a denial‑of‑service condition.

This flaw is present in all Linux kernel releases that include the buggy drm_gem_fb_init_with_funcs() implementation. The vendor list indicates that the Linux kernel itself is affected; no specific version range is provided, so the vulnerability applies to every kernel version until the patch is applied.

The vulnerability has a CVSS score of 7.8, indicating high severity, and an EPSS score of <1%, implying a low likelihood of exploitation. It is not listed in the CISA KEV catalog, suggesting no known public exploits. Exploitation requires a local process that can invoke DRM ioctl calls to create or modify framebuffer objects, a capability normally restricted to users with GPU access. The likely attack vector is a local attempt leveraging these ioctl interfaces; based on the description, it is inferred that such activity can trigger out‑of‑bounds memory accesses that may result in kernel memory corruption or a crash, potentially enabling code execution or denial of service.