In the Linux kernel mailbox subsystem, the mchp‑ipc‑sbi driver used hartid to index a per‑CPU configuration array. Because hartid values are not guaranteed to be contiguous or limited to the number of online CPUs, the driver could access memory outside the bounds of the array. The patch replaces hartid with cpuid, which is guaranteed to be within the valid range provided by the online CPU enumeration. The flaw is an out‑of‑bounds memory corruption (CWE‑125, CWE‑1285) that could affect kernel memory integrity.

Any Linux kernel containing the upstream mchp‑ipc‑sbi driver before the commit that switches to cpuid indexing is affected. The vulnerability applies to kernels that have not yet incorporated the patch. No specific version ranges are available; all supported kernels that still use the old implementation remain vulnerable.

The flaw is an out‑of‑bounds memory corruption (CWE‑125, CWE‑1285). The CVSS score of 8.4 indicates high severity, and the EPSS score of < 1% suggests low current exploitation probability. It is not listed in the CISA KEV catalog, indicating no confirmed exploits. The likely attack vector is local: an attacker would need to trigger the mailbox function on a system with the vulnerable driver. Because the vulnerability can affect kernel memory, the risk is considered high for affected systems.