In the Linux kernel, the xe_vm_madvise_ioctl() interface fails to validate PAT indices supplied for the coh_none coherency mode when applied to CPU‑cached buffers. The clear operation then remains dirty in the CPU cache. A GPU operating in coh_none mode can bypass these caches and read stale data directly from DRAM, potentially exposing sensitive information that had been freed by other processes. This flaw represents improper input validation and leads to an information disclosure vulnerability, aligning with CWE‑401.

The affected product is the Linux kernel. Any kernel version that does not include the patch rejecting coh_none PAT indices for CPU‑cached memory is vulnerable. The relevant commit identifiers are 4e5591c2fc1b30f4ea5e2eab4c3a695acc404e39 and 87f9b1528e1ffc1da3615d552c9a06aba5e20b00, so all releases preceding these commits should be considered at risk.

Based on the description, it is inferred that the vulnerability can be triggered via a DRM ioctl call, requiring a user‑level process that has write access to the DRM device. The CVSS score is 7.0, which is considered high. The EPSS score is < 1%, and the vulnerability is not in the CISA KEV catalog, so exploitation may be limited to local users with GPU driver access. The risk remains significant until a vendor patch is applied.