The vulnerability resides in the Linux kernel HID-BPF subsystem, where the return value of dispatch_hid_bpf_raw_requests is used as a buffer size in hid_hw_request without validation. This oversight combines an integer-incorrect conversion (CWE-131) with a subsequent buffer overflow (CWE-787), allowing the kernel to attempt copying far more data than the buffer can contain. The result is memory corruption that could lead to kernel crashes or privilege escalation if an attacker can influence the value returned by that function.

The flaw targets the Linux kernel itself, affecting all releases that contain the vulnerable HID-BPF code prior to the fix. The available CPE data references kernel versions 7.0‑rc1 through 7.0‑rc4, but the issue likely applies to any kernel version with the HID‑BPF implementation that has not yet been patched. System administrators should treat any such kernel revision as exposed until the patch is applied.

With a CVSS score of 7.8 the vulnerability is high severity, but its EPSS score of less than 1 % indicates a low probability of exploitation currently, and the vulnerability is not listed in the CISA KEV catalog. The CVE description suggests that exploiting the issue requires the attacker to supply a custom HID‑BPF program that the kernel will process. While the exact attack vector is not detailed in the advisory, it is inferred that writing a malicious BPF program and delivering it to a system that enables HID-BPF could trigger the overflow, potentially resulting in kernel memory corruption.