The vulnerability is a heap out-of-bounds read in the Linux kernel DRM subsystem. When parsing a DisplayID tiled block, the code casts raw data to a fixed layout and reads up to seven topology identifiers without verifying the declared length, causing the read to extend past the end of the duplicated EDID data. An attacker can supply a crafted EDID block with a small num_bytes field, forcing the kernel to read beyond the allocated buffer. This exposes kernel memory and can be used for information disclosure or as a stepping stone to other memory corruption attacks.

Affects all Linux kernel releases that include the drm_edid DRM driver before the fix is applied. The issue is present in every distribution that ships the unpatched upstream kernel, regardless of distribution version. It impacts any system where the kernel parses EDID information from attached monitors or other display devices.

The CVSS score is 7.1, and the EPSS score is <1%, indicating a low probability of widespread exploitation. The exploit requires a device that sends a crafted EDID, making the attack likely local and device‑centric. An attacker can trigger the read by connecting a malicious monitor or other display interface that supplies a malformed tiled‑display block. Since the read occurs in kernel space, information exposure could aid subsequent exploits, raising the overall risk level to moderate or higher in environments where untrusted display hardware could be introduced. The lack of a KEV listing suggests that the vulnerability is not yet known to be actively exploited in the wild.