In the Linux kernel DRM Komeda driver, an integer overflow occurs when computing the minimum required buffer size for an AFBC framebuffer. The overflow causes the validation to incorrectly succeed, allowing userspace to supply an undersized drm_gem_object that can write beyond the intended memory region. This out-of-bounds write may corrupt kernel memory or crash the system, potentially enabling arbitrary code execution in kernel mode or causing a denial of service. The flaw stems from insufficient bounds checking during an arithmetic addition.

The vulnerability exists in the Linux kernel, affecting any kernel build that contains the Komeda DRM driver before the patch that adds check_add_overflow. The vendor is Linux and the product is the Linux kernel; no specific version range is listed, so any kernel missing the fix is potentially vulnerable.

The EPSS score is not available, and the issue is not listed in KEV, leaving the public exploitation likelihood uncertain. Nonetheless, an integer overflow in a kernel driver suggests a high‑impact flaw triggered by local users who can open DRM devices. If exploited, an attacker could achieve kernel privilege escalation or destabilize the system via memory corruption.