The Linux kernel’s auxdisplay line-display subsystem contains an out-of-bounds read when a user writes zero bytes to the message sysfs attribute. The function unserializes the input without checking length first, so msg[count-1] is accessed with count=0, resulting in a read of memory before the allocated buffer. On KASAN-enabled builds this triggers a fault; on normal builds it silently reads adjacent slab data, potentially revealing nearby kernel memory contents.

The flaw is present in any Linux kernel that utilizes auxdisplay drivers registered via linedisp_register, specifically those such as ht16k33, max6959, img-ascii-lcd, and seg-led-gpio. As the code path is executed for every zero-byte write, any system that loads these drivers and grants write permission to the message attribute is potentially exposed.

The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating a low probability of current exploitation. Based on the description, it is inferred that a local attacker with write access could obtain a kernel out-of-bounds read and potentially trigger a panic in a KASAN-enabled build. The out-of-bounds read exposes adjacent memory contents, which could lead to information disclosure. The impact is limited to the local system context; however, patching is strongly recommended.