The Imagination DRM driver in the Linux kernel allows an unbounded firmware reconstruction count. The driver uses a counter to index a fixed freelist ID array and copies data into a response array, but the code does not bound the counter to the size of these protocol arrays. This omission can lead to read or write accesses outside the allocated memory, potentially corrupting kernel memory and compromising system integrity.

All Linux kernel installations that include the Imagination DRM driver are potentially affected, regardless of distribution or specific kernel release, because the vulnerability resides in the driver code that is part of the kernel image.

The CVSS score is 5.5 indicating a moderate severity, and the EPSS score of less than 1% signals a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to send crafted DRM requests that cause the reconstruction count to exceed the protocol limits; this inference is based on the description of the vulnerability, not directly stated in the input.