This vulnerability allows a malicious actor to create a DMA buffer that references BAR resources which were not verified, permitting the export of DMABUFs that expose unreserved hardware resources. Attackers could read or write to memory ranges intended for exclusive use, potentially leaking sensitive data or corrupting system state. The underlying weakness corresponds to CWE‑1220, a failure to validate external input before use.

The flaw affects all Linux kernel releases prior to the patch that introduces a check of BAR resources in the DMABUF creation path. Both generic Linux kernels and derivatives that have not applied the commit 702809dabdecca807bdd50cfdcc1c980feb2ba62 are vulnerable. There are no version ranges provided in the advisory, so any kernel lacking this commit is at risk.

With a CVSS score of 8.8 the vulnerability is classified as high severity, and an EPSS score of less than 1% indicates a low current exploitation probability. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation likely requires local or privileged access, implying that an attacker must have sufficient kernel or device driver privileges to trigger the flaw.