Virtio_get_edid_block validates the read offset only against the device‑supplied response size, not against the fixed‑size edid array. A malicious virtio‑gpu backend can advertise a large size together with a high block count, forcing the driver to read far past the end of the array into adjacent kernel memory. The leaked data is then surfaced as part of the parsed EDID, resulting in an out‑of-bounds read that reveals kernel memory contents. This vulnerability qualifies as an information‑disclosure flaw.

Linux kernel implementations that include the virtio‑gpu driver are potentially affected. The CVE does not list specific vendor or version numbers; any kernel prior to the commit that introduced the bounds‑checking fix may be vulnerable. Users should verify whether their kernel contains the virtio‑gpu driver and whether the patch has been applied.

The CVSS score of 7.7 indicates a high risk. The EPSS score of < 1% suggests that exploitation is currently unlikely. The flaw is not listed in the CISA KEV catalog, so no known active exploitation has been reported. An attacker who controls a malicious virtio‑gpu backend can read beyond the intended EDID buffer into adjacent kernel memory, potentially exposing sensitive data. The exploit requires the attacker to be able to operate a backend in an environment where the virtio‑gpu driver is active, such as a virtual machine hosted by the attacker; it does not provide elevation of privilege or remote code execution on its own.