The flaw is located in the Linux kernel’s Nouveau DRM driver. A commit that expanded the device‑private region size was made without correspondingly enlarging the backing VRAM buffer object. As a result, the helper routine nouveau_dmem_page_addr() returns an offset that points beyond the allocated buffer once pages enter the second or subsequent chunks. This mismatch enables out‑of‑bounds memory accesses, allowing a local kernel attacker to corrupt kernel memory or read data that should be protected.

All Linux kernels that expose the affected Nouveau code path are vulnerable. The issue persists in kernel releases that include the commit and precede the downstream patch that corrects the buffer‑object sizing. Systems that have the Nouveau driver enabled and have not yet upgraded to the fixed kernel are at risk.

The CVSS score of 7 categorises this as a high‑severity kernel vulnerability, and the EPSS score of less than 1 % indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalogue, suggesting that no active exploitation has been observed. Based on the description, it is inferred that exploitation would most likely require local privileged access—such as root or a compromised kernel module—since the memory corruption occurs within the kernel context and depends on the Nouveau driver being loaded. The likely attack vector is local execution, an inference drawn from the kernel memory corruption described.