A kernel bug in the DRM DisplayPort sideband reply parsers allows an out‑of‑bounds read of 16‑bit fields when the parser reaches the end of the received message. The parser reads raw->msg[idx+1] without checking that idx+1 is within the message length, causing kernel memory beyond the supplied data to be read and copied into internal structures. This enables an attacker to leak confidential kernel data, potentially exposing sensitive information such as process credentials or system memory state. The weakness resides in improper boundary validation and is classified as an out‑of‑bounds read.

The flaw affects all Linux kernel releases that include the DRM subsystem’s sideband parsing code—essentially every standard Linux distribution kernel prior to the patch commit. Vendors to note are Linux kernel maintainers (e.g., Ubuntu, Fedora, Debian), and any system using the kernel’s DisplayPort sideband features may be impacted until a fixed kernel is deployed.

The CVSS score is not provided and the EPSS score is unavailable, but the vulnerability is listed as not being in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to supply a malicious sideband reply to the kernel’s DisplayPort parser; the likely attack vector is through a local user with access to the GPU device or an attacker able to load a malicious driver. The exploit complexity appears moderate since the out‑of‑bounds read is triggered by boundary checks performed after the read. Although no public exploit exists, the potential for information disclosure warrants prompt attention.