A shift‑out‑of‑bounds error occurs in the Linux kernel’s NTB switchtec driver when the number of MW Look‑Up Tables (LUTs) is set to zero. The rounddown_pow_of_two function was called with a zero value, which is undefined behavior. This can corrupt kernel memory or cause a crash, potentially enabling an attacker to gain arbitrary code execution or cause a denial of service.

The vulnerability affects any Linux system that loads the ntb_hw_switchtec driver and configures the NTB with zero MW LUTs. The exact kernel version range is not specified, so all kernel releases that contain the vulnerable code before the patch are affected.

Because the flaw is in the kernel, it carries a significant impact if exploitable, although the lack of an EPSS score and KEV listing suggest no widespread, publicly available exploitation. The most likely attack vector would involve local or physical access to the NTB device, or a compromise that can alter driver configuration. Applying the patch that guards against the zero‑value case mitigates the risk.