During PCI probe the cirrus-qemu driver maps the device’s BAR0 region without verifying that its size matches the expected 4 MB VRAM region. If a device provides a smaller BAR0 the driver maps a truncated memory area. Subsequent framebuffer updates copy data into this region, writing past the end of the mapped address space and triggering a supervisor write page fault that crashes the kernel. The vulnerability is an out‑of‑bounds memory write (CWE‑787) that results in a denial‑of-service condition but does not provide arbitrary code execution.

All Linux kernel variants that include the cirrus‑qemu driver are affected. The flaw manifests when a PCI device with a BAR0 smaller than the expected 4 MB is bound to the driver, which can happen in virtualized or hardware environments where such devices are present. No specific kernel release range is listed, so any build containing the unpatched driver source is considered at risk.

The CVSS score of 5.5 indicates medium severity. The EPSS score of < 1% shows a very low but nonzero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector is inferred to require that the attacker have access to the target’s PCI subsystem, which typically means physical or privileged access. Exploitation demands that a device with a BAR0 smaller than 4 MB be bound to the driver, limiting the attack surface to insiders or physical access attackers. If the conditions are met, the kernel panic results in a service interruption for the system.