The ntb_hw_switchtec driver in the Linux kernel contained an array-index-out-of-bounds issue that arises when the number of middleware LUTs derived from an NTB configuration exceeds the bounds of the mw_sizes array. Prior to the patch, an out-of-bounds access could read or write kernel memory beyond its allocated boundary, potentially leading to unintended kernel behavior or instability. The commit adds a bounds check and refuses the invalid configuration, emitting a warning that the configuration is not valid.

All Linux kernel builds that include the ntb_hw_switchtec driver and have not incorporated the patch commit are affected. No specific kernel release is identified, so any kernel version prior to the inclusion of the bounds check is at risk. The generic CPE indicates the Linux kernel, and the vendor product list only references Linux kernels in general.

EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. No CVSS score is provided. The likely attack vector is an invalid NTB configuration supplied by a device connected to the NTB interface, which may be feasible from an untrusted source. Because the failure mode is an out-of-bounds access in kernel space, an attacker could theoretically destabilise the kernel, causing a denial‑of‑service or other impacts. No public exploit has been reported at this time.