This vulnerability occurs in the Linux DRM DP MST subsystem during sideband reply processing. The loader performs buffer appends that can overflow three different buffers when the device sends malformed content. The result is a buffer over-read and write beyond the boundaries of the chunk, msg, and the surrounding structure. Such out-of-bounds operations can corrupt kernel memory and can be leveraged to execute arbitrary code or crash the kernel.

Affects all Linux kernel distributions that include the drm_dp_sideband_append_payload() routine without the patch. The vulnerability is present in the kernel's Direct Rendering Manager (DRM) displayport (DP) infrastructure. All devices that expose DP MST sideband channels on a physical connection are susceptible. Specific kernel versions are not enumerated but the patch is rooted at commits referenced in the given links. Systems using older kernels predating the patch commits are vulnerable.

The risk is medium because the vulnerable code runs in kernel mode and can be triggered by any DP MST device that can forge sideband replies. The CVSS score of 6.0 indicates a medium severity impact, and the EPSS score of less than 1% suggests low likelihood of exploitation but not zero. The vulnerability is not listed in the CISA KEV catalog; however, due to the possibility of remote code execution it remains a serious concern. A malicious device or compromised peripheral could deliver malformed sideband data over a physical link.