The vulnerability exists in the Nouveau DRM driver of the Linux kernel. When an attacker writes a value to the debugfs 'pstate' file, the kernel passes that value to nvkm_clk_ustate_update, which walks an internal list of clock states. If the supplied identifier is not present in the list, the loop ends without setting a flag and the code later dereferences the list head as an nvkm_pstate, performing an out-of-bounds read. This flaw causes the kernel to inadvertently expose arbitrary data from its address space, potentially leaking sensitive information or facilitating privilege escalation.

All Linux kernel distributions that ship the unpatched Nouveau driver are affected. The flaw exists in any kernel version built with the old nvkm_clk_ustate_update implementation, before the commit that introduces the "found" variable. Systems that expose the /sys/kernel/debug/drm/nouveau/... pstate interface to local users or services are at risk; the vulnerability is not triggered by remote input but by local write access to debugfs.

A local attacker with write access to the debugfs pstate file can supply an arbitrary index, causing the kernel to perform an out-of-bounds read that may disclose kernel memory and could be leveraged to elevate privileges. The flaw is not currently listed in the CISA KEV catalog, and no exploitation probability is supplied by the CVE data. The potential for information disclosure suggests a high impact, contingent on the attacker’s ability to craft the exploit locally.