The vulnerability involves an incorrect sizing of the VRAM buffer object in the Linux kernel's nouveau DRM driver. Because the driver registers a larger memory range than the backing buffer, pages beyond the first chunk resolve to VRAM regions outside the intended buffer object. This miscalculation allows a local attacker with kernel privileges to read or potentially write out‑of‑bounds memory, compromising confidentiality and integrity. The weakness relates to improper memory boundary checks, publicly identified as CWE-119.

Linux operating systems running kernel versions including the nouveau graphics driver. No specific kernel version list is given, but the issue exists due to a commit that adjusted device‑private region sizing. Affected users are those with Nouveau GPU support enabled in the kernel.

The CVSS score is not provided, but the flaw allows memory corruption within the kernel, which is typically considered a high‑severity issue. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, indicating low publicly known exploitation yet a strong potential impact. Exploitation would likely require local privileged access, such as root or a compromised kernel module, though a detailed attack path is not explicitly documented in the advisory.