The Linux kernel DRM HDMI module had a flaw where an audio infoframe intended for the connector was copied into a generic destination buffer using the size of the destination instead of the source. This caused the function to read up to 60 bytes from only a 28‑byte allocation, resulting in a buffer over‑read. The vulnerability does not corrupt memory, but it can read unintended data and may trigger a crash or kernel panic if the out‑of‑bounds read falls off a page boundary. The weakness aligns with a classic buffer over‑read (CWE‑119).

All Linux kernel builds that include the buggy DRM HDMI audio infoframe copying code before the patch commit. Vendors shipping kernel versions that have not incorporated this fix are affected.

The CVSS score is 7.1, and the EPSS score is <1%. Because the flaw resides in a kernel driver that processes data from an HDMI source, it would require a malicious or specially crafted HDMI audio payload or physical access to trigger. The impact is limited to information disclosure and possible denial of service. The vulnerability is not in the CISA KEV catalog, and no widespread exploitation has been reported.