The flaw originates in the DRM Imagination subsystem of the Linux kernel, where the pvr_set_uobj_array() function copies kernel objects to a user‑supplied array using a stride parameter. If the stride provided by the caller differs from the size of the kernel object, the routine incorrectly advances the user‑space pointer by the kernel object size while advancing the kernel pointer by the user‑space stride. This inversion can lead to subsequent copies reading from incorrect kernel addresses or writing to wrong user‑space offsets, and the padding clear operation applies only to the first element. The erroneous pointer adjustments create out‑of‑bounds or misaligned memory accesses, corrupting kernel data structures or leaking kernel memory to user space.

Any Linux kernel that includes the Imagination DRM driver and does not yet contain the commit that fixes the stride calculation is affected. No specific kernel release numbers are listed, so versions prior to the application of commit 09beaf4aec05b0525f2153dce693f3eb3166697a are potentially vulnerable.

The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the derailing of pointer adjustments requires an attacker to invoke the vulnerable DRM interface, implying a local attack vector. Once successfully triggered, the memory corruption can be severe enough to compromise kernel integrity, potentially resulting in privilege escalation or system compromise. The exploitation likelihood remains uncertain due to the lack of publicly disclosed exploits, but the defect is serious enough to warrant immediate attention for systems that run the affected driver.