The ibmasm command_file_write handler copies user‑supplied data into a kernel buffer that is exactly count bytes long, but it does not validate the dot command header before extracting command_size and data_size. Because both the allocation size and the header fields can be set by the attacker, a crafted command can cause get_dot_command_size() to return a larger value than the buffer, leading to out‑of‑bounds reads in get_dot_command_timeout() and an out‑of‑bounds memcpy_toio() that leaks kernel heap bytes to the service processor. This results in kernel information disclosure that could be used for privilege escalation or further exploitation. Based on the description, it is inferred that the vulnerable code is invoked when a user writes to the /dev/ibmasm command file, so the attack requires local write access to that device.

The vulnerability affects Linux systems that load the ibmasm kernel module. No specific kernel version is listed, so all kernels running the vulnerable ibmasm implementation are potentially impacted.

The CVSS score is not provided in the data, and EPSS is not available, indicating that no public exploitation metrics exist. The vulnerability is listed as not in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires write access to the ibmasm command file interface, suggesting a local or user‑level attack vector. No publicly available exploit has been documented, and the risk depends on the presence and configuration of the ibmasm module in the target system.