The Linux kernel routine cper_print_fw_err() performs a hex dump of firmware error records without verifying that the requested offset fits within the error record’s length. When a malicious firmware record supplies an offset larger than the record size, subtracting the offset causes an unsigned underflow, yielding a negative length that expands the dump to the entire surrounding memory. The kernel then spends excessive time printing large regions, discloses kernel memory contents that may be captured by user processes or logs, and can crash with an OOPS if the calculated dump area extends into unmapped memory.

All Linux kernel releases that support CPER or EFI firmware error handling are potentially affected, including the explicit kernel versions listed in the CPEs: 5.7 and 5.7‑rc7. The flaw is present in the current stable source tree until the upstream patch is applied, so any deployment that has not yet updated to a patched kernel is vulnerable.

The vulnerability has a CVSS score of 5.5, indicating moderate severity with potential for information disclosure and service interruption. The EPSS score of <1 % reflects a low probability of exploitation, and it is not listed in the CISA KEV catalog. Exploitation would require supplying a crafted firmware image or compromising the firmware supply chain; the attacker would trigger the underflow by inserting an oversized offset, leading to extensive memory dumps or a system crash. While the risk is moderate, the likelihood of real‑world exploitation remains low under normal circumstances.