In the Linux kernel, the functions that parse remote DisplayPort sideband replies lack bounds checks when copying data from the received packet. The code copies num_bytes bytes from a raw message buffer without confirming that the source offset plus num_bytes does not exceed the message length. Because num_bytes is an 8‑bit value, the missing check allows a malicious or buggy Multi‑Stream Transport hub to request a read that overflows the buffer, resulting in an out‑of‑bounds read. This vulnerability can expose unintended kernel memory contents to an attacker, enabling information disclosure or potential exploitation through a subsequent memory corruption path.

The weakness appears in the Linux kernel DRM subsystem. No specific kernel versions are enumerated in the advisory; therefore, any kernel that implements the DisplayPort multi‑stream transport sideband logic and has not been updated to the patched code may be vulnerable. Attackers that can interact with the system via a DisplayPort connection that includes an MST hub pose the main risk.

The CVSS score of 5.0 indicates a medium severity. The EPSS score is <1%, suggesting a low probability of exploitation, but since the vulnerability is not listed in the CISA KEV catalog, no current exploitation evidence is known. The likely attack vector involves a connected MST hub that issues out‑of‑bounds read requests. Once triggered, the attacker can read arbitrary kernel memory, which could lead to information disclosure or, if further exploitation techniques are applied, potential remote code execution. Administrators should assess risk for systems connected to external MST hardware.