The Linux kernel contains a logic flaw in cper_print_fw_err() where the error record length is not validated against the offset when processing CPER firmware error data. On the presence of malformed firmware, subtracting the offset from the length can underflow, causing the routine to attempt to dump the entire memory region. An attacker who can supply such firmware can trigger this behaviour and cause excessive resource consumption, unintentional OOPS crashes, or expose kernel memory contents to userspace logs or consoles.

Linux kernel instances, any configuration that loads CPER or EFI firmware records on boot or runtime. No specific kernel release is listed in the available data, so the issue may apply to all recent kernels until the patch is applied.

The conditions for exploitation require the attacker to influence the firmware record processed by the kernel, which can be achieved through deployment of malicious firmware or exploiting vendor supply chain trust. While the CVSS score is not provided, the potential for information disclosure and denial of service suggests a high severity vulnerability. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalogue yet. An exploit would involve injecting a crafted firmware record that causes the memory dump to underflow and read outside the intended bounds, potentially exposing kernel or user memory.