The bug arises in the drm/i915/gem driver of the Linux kernel when the function sg_page() returns a struct page pointer, causing the scaling of pread and pwrite operations on physical buffer objects (BOs) to be incorrect. A request that supplies a non‑zero offset can read or write memory outside the intended BO boundaries, providing a path to kernel memory corruption. This flaw is categorized as CWE‑823, reflecting an invalid pointer operation.

The issue affects Linux kernel implementations that include the i915 DRM driver and use physical BOs accessed through pread/pwrite with an offset. Systems running kernel versions that lack the commit 3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6—"—remain vulnerable. Known affected platform used overlay or cursor planes with physical mapping on Intel Gen3/945G/Lakeport GPUs, meaning older i915 graphics setups are the likely target.

The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating a low current exploitation probability. Based on the description, it is inferred that exploitation would require privileged kernel code to invoke pread/pwrite on a physical BO with a non‑zero offset, so the attack vector is local and limited to systems running vulnerable kernel builds. If exploited, the resultant memory corruption could lead to a crash or denial of service, but the description does not mention privilege escalation or data exfiltration.