The Linux kernel fails to validate a PAT index supplied by users through the xe_vm_madvise_ioctl() interface. When the kernel is asked to use the coh_none (XE_COH_NONE) coherency mode on a CPU‑cached buffer, the clear operation remains in the CPU cache and becomes dirty. A GPU that operates in coh_none mode can bypass CPU caches and read that stale data directly from DRAM, potentially exposing sensitive data that was previously freed by other processes. This flaw represents an improper input validation weakness that enables information disclosure.

The affected product is the Linux kernel. Any kernel version that does not include the patch that rejects coh_none PAT indices for CPU‑cached memory is vulnerable. The relevant commit identifiers are 4e5591c2fc1b30f4ea5e2eab4c3a695acc404e39 and 87f9b1528e1ffc1da3615d552c9a06aba5e20b00, so all releases preceding these commits should be considered at risk.

Based on the description, it is inferred that the vulnerability can be triggered via a DRM ioctl call, requiring a user‑level process that has write access to the DRM device. The CVSS score is 7.0, which is considered high. The EPSS score is not listed, and the vulnerability is not in the CISA KEV catalog, so exploitation may be limited to local users with GPU driver access. The risk remains significant until a vendor patch is applied.