The dpaa2-switch driver in the Linux kernel reads a numeric value, num_ifs, supplied by firmware without proper bounds checking. The driver assumes that this value never exceeds 64 interfaces and writes the interface indices into a statically sized array of 64 elements. If the firmware provides a value of 64 or greater, the driver writes beyond the end of the array, corrupting neighboring memory. Such memory corruption in kernel space may allow a malicious user to gain elevated privileges or disrupt system operation, potentially leading to a crash or arbitrary code execution.

All Linux kernel installations that include the dpaa2-switch driver without the recent bound‑check patch are affected. This encompasses any system using the upstream Linux kernel. Although no specific version range is listed, the vulnerability exists in kernels prior to the commit that introduced the num_ifs validation.

The vulnerability is not currently listed in CISA's KEV catalogue and an EPSS score of 0.00024 (< 1%) is available, so the statistical likelihood of exploitation is undetermined. However, because it is an out‑of‑bounds write in kernel code, the potential impact is severe should an attacker be able to supply a malicious firmware value or otherwise influence the num_ifs parameter. The is inferred to be local or device‑level, requiring control over firmware or the network device that feeds into the driver. The CVSS score of 7.8 indicates high severity.