The patch introduces a sanity check for the DMC firmware load address in the i915 DRM driver. Previously, firmware version 3 stored its load address in dmc_info->start_mmioaddr without validation, allowing an attacker to supply a malicious start address that could direct the driver to map or write to an unintended memory region. This absence of bounds checking is an out‑of‑bounds access flaw (CWE‑119) that could corrupt kernel memory, enabling privileged code execution or denial of service.

All Linux kernels containing the i915 DRM driver prior to the commit that added the sanity check are affected. This includes standard distribution kernels where the driver lacks validation for DMC firmware load addresses. Systems utilizing Intel GPUs that load untrusted or custom DMC firmware via the DRM subsystem are therefore at risk.

Exploitation requires the attacker to influence the firmware image loaded by the i915 driver, which typically demands local or privileged control but could also be achieved through hardware manipulation of the firmware channel. Although the CVSS score is not provided and EPSS data is missing, the nature of the flaw suggests a high severity vulnerability with non‑negligible attack probability. The issue is not yet listed in CISA’s KEV catalog, indicating limited public exploitation, but the omission of validation warrants prompt remediation.