The vulnerability occurs in the Cedrus DRM driver of the Linux kernel. It originates from the driver reading H.264 reference list entries from a stateless slice control and later using these indices to index the decode->dpb[] array. Because the driver accepts indices that may be outside the bounds of the V4L2_H264_NUM_DPB_ENTRIES array, an out‑of‑bounds read of kernel memory can occur. The exposed memory may reveal sensitive kernel data but does not directly allow execution of arbitrary code. This type of flaw is categorized as CWE‑125.

The affected vendor and product are the Linux kernel (Linux:Linux). Any kernel build that includes the Cedrus media driver prior to the commit that guards against invalid reference indices is impacted. No specific kernel release series is listed in the CNA data, so all kernels that have not applied the hotpatch or newer releases containing the fix are vulnerable. Users of distributions that ship older kernels with the Cedrus driver should verify whether their kernel version contains the commit that implements the bounds check.

The CVSS v3.1 base score is 7.1, indicating a high‑severity medium‑range impact. The EPSS score is less than 1%, suggesting a low probability of exploitation. The vulnerability is not in the CISA KEV catalog. The likely attack vector is a local user with access to a video device that uses the Cedrus driver. The attacker would need to supply a malformed H.264 stream to the driver; the subsequent out‑of‑bounds read could leak kernel memory content. Because the CVE description does not state that the flaw can be used to gain code execution, the precise impact on privilege escalation cannot be confirmed. However, the data leakage itself can be a stepping stone for further exploitation in a local environment.