The vulnerability resides in the Nouveau driver of the Linux kernel. A loop that walks the kernel’s list of clock states can exit without setting a flag when the requested state ID is not present. This results in the code later dereferencing the list head as an nvkm_pstate structure, producing an out-of-bounds read. The flaw allows a kernel to expose arbitrary data from its address space, potentially leaking sensitive information.

All Linux kernel distributions that ship the unpatched Nouveau driver are affected. The issue exists in kernel builds that use the original nvkm_clk_ustate_update implementation before the patch adding the "found" variable. The trace is reachable from userspace through the debugfs pstate interface under /sys/kernel/debug/drm/nouveau, so any system exposing that file to local users or services is at risk.

A local attacker with write access to the debugfs pstate file can supply an arbitrary index, triggering the out‑of‑bounds read. The CVSS score is 4.4 and the EPSS score is < 1%, indicating low severity and a very low likelihood that the exploit will be used. The vulnerability is not listed in the CISA KEV catalog. The attack requires local access and can be mitigated by restricting the file’s write permissions or removing the debugfs mount. No remote exploitation path is described in the data.