The vc4 DRM driver incorrectly leaves the VM_MAYWRITE flag set after rejecting writable mappings of shader buffer objects that have already been validated. This oversight lets a user process map a shader object read‑only, then call mprotect to change the mapping to writable, rewrite the validated shader code, and execute arbitrary GPU instructions. The vulnerability therefore bypasses the shader validator and enables uncontrolled GPU code execution and potential data leakage. The impact is an access‑control bypass that could lead to arbitrary code execution within the GPU context; it does not explicitly grant kernel privilege escalation.

Linux kernels running a vc4 DRM driver that predates the patch commit 019e6ad247f7fd038d2e009789f6d9bfcccb1ae7 are affected. All systems using the driver, regardless of the specific hardware, are vulnerable.

The CVSS score of 7.8 indicates high severity, raising the risk level. The EPSS score is less than 1 %, indicating a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is local: any process that has permission to open the DRM device can exploit the flaw. If successful, the attacker can alter validated shader code, potentially enabling arbitrary GPU code execution or information disclosure. These details are inferred from the description; the CVE does not state the exact exploitation conditions.