The kernel contains an out‑of‑range memory read in the IMX8M block controller removal routine, which can cause the kernel to access invalid memory. Such an access can lead to a crash or, in the worst case, provide an attacker with a vector for memory corruption. The flaw represents a typical bounds checking failure (CWE‑125).

All Linux kernel releases that include the imx8m_blk_ctrl driver prior to the applied fix are affected. The vulnerability applies to kernel versions 6.19-rc1 through 6.19-rc8 and to any build matching the generic Linux kernel identifier. Unpatched kernels that load the block controller module are vulnerable.

The CVSS score of 7.1 indicates a high impact if successfully exploited. The EPSS score is below 1%, suggesting that active exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. The likely attack requires a user with kernel module load or remove privileges, implying a local or privileged exploit. An attacker with sufficient privileges could trigger the fault by removing the block controller module, which could lead to a denial of service or, in a more advanced scenario, memory corruption.