This is a buffer over-read or out-of-bounds write vulnerability (CWE-787). In the Linux kernel driver for Broadcom VC4, a flaw causes the driver to write the full buffer object size to a position counter when the buffer is actually only a 512 KB slot. This mis‑calculates limits during a binner out-of-memory event, allowing the PTB component to write tile lists beyond the intended slot into adjacent slots and even into unrelated CMA memory. The result is arbitrary memory corruption performed by the GPU, which manifests as GPU hangs, corrupted userspace heap, permanent GPU wedging after the first incidence, and in some cases full system crashes.

All Linux kernels that ship the drm/vc4 graphics driver are affected. No specific versions are listed in the advisory, so any kernel that has not yet incorporated the patch is considered vulnerable.

The vulnerability can be triggered by submitting a driver command that causes the binner to overflow. Based on the description, it is inferred that an attacker with local user privileges could trigger the overflow by generating specific GPU workloads, potentially leading to corruption of privileged memory and privilege escalation. The advisory reports a CVSS score of 7.8 and an EPSS of <1%, indicating moderate severity but low probability of exploitation. The issue is not listed in the CISA KEV catalog. Nonetheless the high impact of arbitrary memory corruption combined with the ability to trigger it via GPU workloads means the risk to affected systems is significant.