The kernel’s rs9 driver reserves only eight struct clk_hw slots, but device 9FGV0841 has eight outputs that register eight clk_hw pointers. When the driver writes pointers 4..7 into the clk_dif array, the array bounds are exceeded, overwriting adjacent structure data. This out‑of‑bounds write corrupts the rs9_driver_data structure and adjacent memory, leading to unpredictable kernel behavior. In many cases the system does not crash immediately, but the kernel is guaranteed to crash when the driver is unbound or during suspend, and the memory corruption could be leveraged by a local attacker to achieve privilege escalation or denial of service.

The vulnerability affects Linux kernel builds that include the rs9 clock driver, before the patch that increases the clk_hw pointer array to accommodate all 8 outputs of the 9FGV0841 device. Versions of the kernel in which this driver is compiled and the device is (or could be) in use are impacted. No specific kernel version range is provided in the advisory, so any kernel that ships the unpatched rs9 driver is potentially vulnerable.

The vulnerability is an out-of-bounds write that can corrupt kernel memory (CWE‑787). The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Because the flaw occurs in a device driver, the likely attack vector requires the attacker to have local access and the ability to interact with the 9FGV0841 hardware (or to develop a kernel module that loads the driver). A successful exploitation could result in kernel panic or provide a foothold for privilege escalation. The lack of publicly known exploits means risk depends primarily on the exposure of the device and the presence of the patched driver.