The ibmasm_send_i2o_message() routine in the Linux kernel uses the command_size field of a user‑controlled dot command header to calculate the copy length for a memcpy_toio() operation, but this length is never validated against the actual allocation size. As a result, a locally privileged user can craft a dot command with inflated header values, causing the kernel to read up to approximately 65 KB beyond the end of the buffer. The over‑read data is then sent to the service processor over MMIO, exposing sensitive kernel memory content and potentially desynchronizing the processor by delivering an inconsistent I2O message header. This flaw is an instance of out‑of‑bounds read (CWE‑125).

All Linux kernel distributions that include the buggy ibmasm_send_i2o_message() implementation are affected. No specific patched version list is provided, so any kernel built before the regression fix should be treated as vulnerable. The attacker requires root access and the capability to issue custom dot commands via the IBM ASM I2O interface.

The exploit requires local root privileges and involves submitting a specially crafted dot command header. Based on the description, it is inferred that the vulnerability poses a medium severity risk as reflected by the CVSS score of 5.5. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Consequently, remote exploitation is unlikely without prior local compromise, but the impact can lead to information disclosure and service processor desynchronization if exploited.