When a user or process issues an ioctl to the CCP driver to retrieve the CPU ID, a firmware command may fail due to an invalid length. In that case, the kernel mistakenly copies the raw ID data to userspace before checking whether the command succeeded. This out‑of‑bounds copy allows the kernel to inadvertently expose internal kernel memory to a user process, leaking potentially sensitive data. The bug falls under the category of a kernel memory overflow that can lead to information disclosure. The impact is a confidentiality breach that could be leveraged for local privilege escalation if an attacker can extract privileged data from the leaked memory.

The security issue appears in the Linux kernel for all vendors identified as Linux:Linux. No specific kernel release versions are provided in the CNA data, so any kernel build that includes the unpatched CCP driver is potentially affected.

The attack requires local execution privileges sufficient to access the CCP IOCTL interface; no remote vectors are described and the EPSS score is unavailable, so exploitation likelihood depends on the presence of unprivileged access to the driver. The CVSS score of 7.0 indicates a medium severity, suggesting the potential impact is significant but not critical. Because the bug is not listed in the CISA KEV catalog, it has not yet been observed in the wild. The severity of the confidentiality compromise is high, and the risk is elevated for systems running unpatched kernels or allowing untrusted users to interact with the driver.