The vulnerability resides in the DRM GUD component of the Linux kernel. In the plane property loop, the code erroneously uses req->properties[num_properties + i] as a write index while simultaneously incrementing num_properties, causing the loop to write past the intended array bounds. A USB device that advertises a large number of plane properties can trigger this out-of-bounds write, potentially corrupting kernel memory, causing system crashes, or enabling arbitrary kernel code execution.

All Linux kernel installations that include the DRM GUD driver and have not incorporated the patch that removes the extra '+ i' are affected. The vulnerability exists in kernel versions prior to the commit that fixed the loop logic; distribution maintainers have not yet released a patched version, so any operating system deployed with a vulnerable kernel is at risk.

The bug is a classic out-of-bounds write; it can be exploited by a malicious USB device that instructs the host to advertise the maximum number of plane properties. The EPSS score of < 1% indicates a very low but non-zero probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 7.0 indicates a medium‑to‑high severity, reflecting the potential for kernel memory corruption.