The vulnerability originates in the vmwgfx driver of the Linux kernel, where an arithmetic calculation uses a user‑supplied header size without validating that the size is large enough. If an attacker supplies a header smaller than the expected body size, the subtraction wraps to a very large value, causing a subsequent loop to read beyond the bounds of the kernel buffer. The resulting out‑of‑bounds read can leak kernel data to the attacker. The weakness is a classic example of unchecked pointer arithmetic leading to memory corruption.

All Linux kernel builds that include the vmwgfx graphics driver and have not yet applied the patch. The specific kernel version range is not listed, so affected systems should check for the presence of commits 2666cdd, 85891d1, c77cf8e, dc0be76, or fc0c020 in the tree.

The fixed code path prevents kernel memory disclosure, but the lack of a CVSS score and EPSS data means the precise risk level is unclear. However, a kernel out‑of‑bounds read carries a high confidentiality impact and potential for privilege escalation if the attacker can control the command stream. The exploit seems to require the ability to send crafted data to the vmwgfx driver, which is typically available to all local users; thus the attack vector is local with low environmental barriers.