The Linux kernel’s i915 DRM driver incorrectly handles pread and pwrite operations on physical buffer objects when an offset is supplied. Because sg_page() returns a struct page pointer rather than a void pointer, the scaling calculation mis‑indexes the underlying hardware buffer. A non‑zero offset therefore reads or writes outside the intended BO boundaries, potentially corrupting kernel memory and leading to crashes or service disruption.

Any Linux kernel that has not integrated commit 3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6 is affected. The vulnerability was observed on older Intel Gen3 GPUs (945G, Lakeport) that use overlay or cursor planes backed by physical mapping. Systems running newer kernels or without the older i915 driver are not impacted. Affected platforms include all recent releases of the Linux kernel where the driver exposes the pread/pwrite interface for physical BOs.

The CVSS score of 7.8 indicates high severity, yet the EPSS score is below 1 % and the flaw is not listed in CISA’s KEV catalog, suggesting a low present exploitation probability. Given that the bug triggers on a user‑supplied offset to pread/pwrite on a physical BO, the attack vector is local and requires that the attacker can open the relevant device node and invoke the pread/pwrite operations. Successful exploitation would lead to kernel memory corruption, potentially resulting in denial of service or facilitating further privilege escalation, although no direct privilege escalation is documented in the current description.