The ibmasm command_file_write handler allocates a kernel buffer of exactly count bytes for user data but does not validate the dot command header before calling get_dot_command_size() and get_dot_command_timeout(). Because both the allocation size (count) and the header fields (command_size, data_size) are user‑controlled, an attacker can craft a command that causes get_dot_command_size() to return a value larger than the allocated buffer, leading to out‑of‑bounds reads in get_dot_command_timeout() and an out‑of‑bounds memcpy_toio() that leaks kernel heap memory to the service processor. This results in kernel memory disclosure, which could be used to facilitate privilege escalation or further attacks. Based on the description, it is inferred that the vulnerable code is invoked when a user writes to the /dev/ibmasm command file, so the attack requires local write access to that device.

The vulnerability affects Linux kernels that load the ibmasm module. No specific kernel version is listed, so any kernel installed with the vulnerable ibmasm implementation is potentially impacted.

The CVSS score of 5.5 indicates a moderate severity. EPSS is not currently available, suggesting no widely publicized exploitation activity. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires write access to /dev/ibmasm, implying a local or user‑level attack vector. No public exploits have been documented, but the risk remains if the ibmasm module is active and accessible to non‑privileged users.