The Linux kernel drm/i915 graphics driver had a vulnerability where the sg_page() function's return type was misused in pread/pwrite operations on physical buffer objects with offsets. Because sg_page() returns a struct page pointer, not a void pointer, the scaling calculation was incorrect, leading to access of incorrect buffer object regions when offsets were non-zero. This could impact platforms using overlay or cursor planes with physical mapping, notably Gen3/945G/Lakeport. The issue was fixed by a specific commit (3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6).

The vulnerability could allow unauthorized reading or writing of incorrect memory regions within physical buffer objects in the drm/i915 driver, potentially leading to confidentiality, integrity, and availability impacts. The CVSS vector indicates local attack vector with low complexity, requiring low privileges, no user interaction, and resulting in high impact on confidentiality, integrity, and availability. However, no known exploits are reported in the wild.

A fix has been implemented and merged into the Linux kernel via the referenced commit. Users should update their Linux kernel to a version that includes this fix. Since this is not a cloud service, remediation depends on applying the official kernel update. Patch status is not explicitly confirmed in the provided data; users should consult the Linux kernel vendor advisory or source repository for the exact fixed versions and apply updates accordingly.