Within the DRM/xe component the Linux kernel incorrectly jumps non‑migratable memory faults that require devmem to an out label, discarding the intended -EACCES error code. The fault is therefore reported as successful to higher kernel layers, masking the true failure and allowing subsequent operations to proceed with an incorrect assumption about memory access or device state. The weakness is a missing check of return values (CWE‑252).

The vulnerability exists in any Linux kernel build that does not contain the remediation commit c4508edb2c723de93717272488ea65b165637eac. Consequently, all vanilla kernels shipped before the inclusion of this commit are affected, while kernels that have applied the commit are no longer vulnerable. This condition is inferred from the commit references provided and the absence of a specific affected‑version list in the data.

The CVSS score of 5.5 indicates a medium severity, while the EPSS score of < 1% reflects a low probability of exploitation. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is a local process capable of generating a devmem fault; the vulnerability does not provide remote code execution or broader privilege escalation. Because the impact is limited to error masking, risk remains moderate until the kernel is patched.