The vulnerability lies in the Linux kernel mailbox helper function fw_mbox_index_xlate, which performs an out‑of‑bounds memory access when a device tree declares #mbox‑cells as 0 and the mailbox controller does not provide fw_xlate or of_xlate callbacks. Without a bounds check, the function can read or write memory beyond the intended range, leading to kernel memory corruption. The CVE description does not state that this flaw can directly cause privilege escalation, but the corruption could compromise the integrity of the kernel.

Any Linux kernel image that includes the mailbox subsystem and that loads a device tree containing a #mbox‑cells=0 entry is impacted. This covers many embedded and desktop distributions that compile the mailbox driver into the kernel, regardless of the specific distribution or kernel version, as long as the default fw_mbox_index_xlate routine is present.

The CVSS base score of 7.1 indicates high severity; the EPSS score of <1% points to a very low probability of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require an attacker to modify firmware or the device tree that the kernel loads during boot, a condition that is inferred from the nature of the flaw. If such modification is possible, the out‑of‑bounds access could destabilize the kernel or be leveraged in indirect ways to affect system behaviour.