The cirrus-qemu driver in the Linux kernel assumes a 4 MB VRAM area defined by CIRRUS_VRAM_SIZE when validating framebuffer sizes. The driver maps PCI BAR0 during probe without checking that the resource size matches this assumption. If a device with a smaller BAR0 is bound, the driver maps a memory region that is too small. Subsequent framebuffer updates copy data into VRAM using a memcpy‑style copy, writing past the end of the mapped I/O memory. This produces a supervisor write page fault that crashes the kernel, causing a denial of service. The weakness manifests as an out‑of‑bounds memory write (CWE‑122) and an improper resource size check (CWE‑119).

All Linux kernel builds that include the cirrus‑qemu driver and may bind to a PCI device with a BAR0 that is smaller than the expected 4 MB. The CNA vendors list shows Linux as the affected vendor, but no specific kernel release or version range is provided, so all affected kernel releases are considered at risk.

The flaw has no known widely available exploit and is not listed in CISA’s KEV catalog. The EPSS score is not available, so the likelihood of exploitation is uncertain. However, the vulnerability requires a vulnerable PCI device to be bound to the driver, meaning the attacker must have access to the hardware or virtualization environment. Because the bug causes a kernel panic, the risk level is high if the conditions are met. The CVSS score is not provided, but the local exploitation potential and impact are significant.