The Linux kernel’s DRM Xe GuC driver incorrectly calculates the size of a steered register list using only the geometry DSS mask. When a platform uses compute‑only DSS bits, the allocation is smaller than the number of entries written, which overflows the buffer and corrupts adjacent slab objects. This memory corruption can cause list_head corruption and SLUB redzone overwrites during device unbind, potentially leading to kernel stability issues or exploitable memory corruption that could be leveraged for privilege escalation or arbitrary code execution.

All Linux kernel installations that include the DRM Xe GuC subsystem and are running a version prior to the commit that fixes the size calculation. The vulnerability applies to any kernel compiled with the affected driver, regardless of distribution, as the CPE indicates a generic Linux kernel.

No CVSS score is provided for this entry, and the EPSS value is not available, so the likelihood of exploitation cannot be quantified from the available data. Because the flaw involves kernel memory corruption, it is a high‑severity condition. The likely attack vector is a local or privileged context where an adversary can influence the DRM driver’s configuration. The vulnerability is not listed in the CISA KEV catalog, indicating that there is no known active exploitation at the time of this analysis.