In the Linux kernel, a flaw in the fbdev core driver’s fb_io_read() function can cause pointer desynchronization when copy_to_user() performs a partial copy. The hardware source pointer is advanced using the original chunk size before the partial copy is detected, leading to additional read cycles that exceed the intended bounds. This results in out-of-bounds I/O reads of framebuffer memory and may expose unintended kernel memory contents. The vulnerability is classified as an out-of-bounds read (CWE-125).

The issue is present in all Linux kernel releases that include the fbdev core driver before the patch is applied. Any system running a vulnerable kernel build—typically unmodified Linux kernel images shipped by distributions—is at risk.

The CVSS score of 7.3 reflects significant relevance to confidentiality and availability. The EPSS score is below 1%, indicating an unlikely current exploitation rate. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that a local user with access to framebuffer devices (e.g., /dev/fb0) would need to trigger the flaw by issuing read requests that result in partial copy_to_user() operations.