The vulnerability enables an attacker to read memory past the end of a fixed‑size buffer that holds TV mode names returned by a GUD device. Because the string passed to the DRM property code is not guaranteed to be NUL‑terminated, the kernel copies its contents with a length calculation that extends beyond the buffer boundaries, exposing arbitrary kernel memory. This out‑of‑bounds read can potentially reveal confidential information and may be leveraged by a privileged attacker to achieve later‐stage escalation or denial of service.

All Linux kernel builds that include the drm/gud driver are affected until the described patch is applied. The flaw exists in the kernel source path drm/gud, regardless of distribution or vendor, and applies to every kernel version carrying the vulnerable code prior to the commit that introduced NUL termination validation.

The risk is moderate to high because the bug can expose kernel memory. Exploitation requires a device that communicates via the GUD protocol and returns a malformed TV mode name. As this interaction occurs in kernel space, an attacker would need physical or logical access to the device (e.g., connecting a malicious display or router) to supply the crafted data. The EPSS score is not available and the flaw is not listed in the KEV catalog, but the absence of a defensive check and the kernel context make the threat materializable under the right conditions.