The vulnerability in the Linux kernel's drm/edid subsystem involves drm_parse_tiled_block() casting a DisplayID block to a fixed layout struct and reading up to tile->topology_id[7] without verifying the block's num_bytes field. A crafted EDID can specify a tiled-display block with a smaller num_bytes than expected, causing the function to read past the allocated memory buffer, resulting in a heap out-of-bounds read. The fix involves rejecting blocks shorter than the specification's 22-byte tiled payload before reading the fixed struct, aligning with existing validation in drm_parse_vesa_mso_data().

This vulnerability allows a local attacker with write access to the EDID data to trigger a heap out-of-bounds read in kernel memory, which can lead to denial of service due to kernel memory corruption or potentially leak sensitive information. The CVSS vector indicates low attack complexity and privileges required, no user interaction, and high confidentiality and availability impact.

A fix has been implemented in the Linux kernel to reject improperly sized tiled-display blocks before processing, preventing the out-of-bounds read. Users and administrators should apply the official Linux kernel updates that include this fix once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.