The Linux kernel DRM logging subsystem contains an out‑of‑bounds read that occurs when a message length of zero is processed. The function drm_log_draw_kmsg_record() accesses s[len-1] without verifying that len is non‑zero; because len is an unsigned integer, a zero value causes the subtraction to wrap to UINT_MAX, allowing a read beyond the intended bounds. An attacker who can trigger this code path could read arbitrary kernel memory, potentially leaking confidential data such as cryptographic keys or internal state. The flaw does not alter data or provide code execution but exposes information that should remain hidden.

All Linux kernel releases that include the unpatched drm/log code are affected. The fix was merged into the stable tree via commit 16a2716910ecf7d31bf3c033ee7c506a0b00b2ee; any kernel version prior to that commit, including most distribution‑supplied kernels before the update, contains the vulnerability. Specific affected ranges are not enumerated in the advisories, so any system running an unpatched kernel that employs the DRM subsystem should be examined.

The CVSS score of 7.1 indicates high severity, and the EPSS score of < 1% indicates a very low exploitation probability, so the overall risk is moderate to low. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local kernel interaction with the DRM subsystem, meaning a user who can load modules or execute privileged code can trigger the read. While it does not enable remote code execution, the potential for arbitrary kernel memory disclosure elevates the risk for environments where kernel memory confidentiality is critical. The likely attack vector is a local privileged user or an attacker who can load a DRM driver to invoke the vulnerable logging path.