The host1x GPU driver in the Linux kernel incorrectly handled the return value from iommu_map_sgtable(), treating a negative error code as a successful size value. It also caused pin_job() to store the erroneous value in an int field, leading to integer overflow. Based on the description, it is inferred that an attacker who can supply a malicious I/O request that triggers this misinterpretation could induce kernel memory corruption, which might lead to privilege escalation or a system crash. The weakness arises from improper signed/unsigned integer handling, which can result in loss of control over kernel objects.

All Linux kernel builds that load the host1x GPU driver. The vulnerability affects embedded systems and SoC platforms that expose GPU acceleration with IOMMU support and use the standard Linux kernel. Any installation running a kernel that includes the driver prior to the patch is potentially vulnerable. The exact kernel release versions are not listed, but the vulnerability is present in kernels before the implementation of the committed fix.

The EPSS score is <1%, and the kernel‑level flaw, together with the potential for privilege escalation or system crash, indicates a high severity. The vulnerability is not listed in the CISA KEV catalog, so no publicly known exploits are referenced. An exploit would most likely target an untrusted user‑space process that interacts with the GPU through the host1x driver or via a device that relies on iommu_map_sgtable(). By inducing a negative error return to be interpreted as a large size, an attacker could corrupt kernel memory or cause a driver crash, which could lead to privilege escalation, though the exact effectiveness depends on specific conditions. The CVSS score of 8.8 highlights the seriousness of this vulnerability.