A missing bounds check in the Linux kernel media dvb‑net driver allows an out‑of‑bounds read of function pointer tables when the ULE extension type field is set to 255. The invalid index can cause the kernel to invoke an unintended function pointer, potentially allowing an attacker to execute arbitrary code with kernel privileges. The vulnerability is a classic example of a bounds check failure (CWE‑1285).

All Linux kernel versions that contain the dvb‑net driver without the recent patch are affected. No specific version range is listed, so any kernel before the fix is considered vulnerable. The issue arises in the handling of ULE extension tables received from network‑controlled data streams over DVB interfaces.

The CVSS score is not provided, and the EPSS score is below 1%. The vulnerability is not in the CISA KEV catalog. However, the impact is severe because execution occurs with kernel privileges. The attack requires the ability to send crafted DVB network data containing a ULE extension with type 255 to a vulnerable system. The exploit is likely to be performed over a network interface, so systems exposed to external DVB traffic should be considered at risk. Due to the low EPSS, widespread exploitation is not yet common, but the potential for remote kernel compromise warrants immediate attention.