In the Linux kernel's IIO DAC driver for the ad3552r‑hs device, an out‑of‑bounds write occurs when a user writes more than 64 bytes to the device node. The kernel code mistakenly uses the original write length (count) to index the buffer during null termination, causing a write past the end of a 64‑byte stack buffer. This flaw can corrupt kernel memory and potentially allow an attacker with local privileges to gain elevated privileges or crash the system. The weakness is classified as CWE‑787.

The issue affects all Linux kernel releases that include the vulnerable ad3552r‑hs driver before the patch was merged. According to the CPE data, the affected kernels include the 6.19 RC builds (rc1 through rc6), but the flaw exists in any kernel in which the driver is compiled. Therefore any system running the Linux kernel with the unpatched driver, including custom or older vendor builds, is at risk. Updating to the patched kernel or applying the upstream fix removes the vulnerability.

The CVSS score of 7.8 indicates a moderate to high severity. The EPSS score is less than 1%, suggesting a low probability of exploitation at the time of the analysis. The vulnerability is not listed in the CISA KEV catalog, reducing the likelihood that a known exploit is circulating. Exploitation requires a local user to write an oversized payload to the device node (e.g., /dev/iio:device? or the corresponding node). This means that the attack vector is local; a non‑privileged user with access to the node can trigger the stack overflow, potentially leading to kernel memory corruption and privilege escalation.