This vulnerability occurs in the Linux DRM DP MST subsystem during sideband reply processing. The loader performs buffer appends that can overflow three different buffers when the device sends malformed content. The result is a buffer over-read and write beyond the boundaries of the chunk, msg, and the surrounding structure. Such out-of-bounds operations can corrupt kernel memory and can be leveraged to execute arbitrary code or crash the kernel.

Affects all Linux kernel distributions that include the drm_dp_sideband_append_payload() routine without the patch. The vulnerability is present in the kernel's Direct Rendering Manager (DRM) displayport (DP) infrastructure. All devices that expose DP MST sideband channels on a physical connection are susceptible. Specific kernel versions are not enumerated but the patch is rooted at commits referenced in the given links. Systems using older kernels predating the patch commits are vulnerable.

The risk is high because the flawed code executes in kernel mode and is reachable from any DP MST device that can forge sideband replies. The EPSS score is not available, but the severity implied by the lack of mitigation and the nature of a kernel buffer overflow suggests a high likelihood of exploitation if an attacker can control the sideband data. The vulnerability is not listed in CISA KEV catalog; however, the potential for remote code execution warrants urgent mitigation. It is likely that a malicious device or compromised peripheral could deliver malformed sideband data over a physical link.