The ibmasm_send_i2o_message() function does not validate user-controlled fields in the dot_command_header before using the derived size for memcpy_toio(). A root user can craft an advanced command header that inflates the declared size, causing the kernel to read up to roughly 65 KB past the end of the allocated buffer. This memory is then forwarded to the service processor over MMIO, allowing information from neighboring heap objects to be exposed and potentially causing the service processor to receive an inconsistent I2O message header, leading to desynchronization or denial of service. The vulnerability is an instance of unchecked buffer over-read (CWE‑68).

All Linux kernel builds that include the vulnerable ibmasm_send_i2o_message() implementation are affected. No specific patched version list is provided, but any kernel prior to the regression fix should be considered vulnerable. The issue is present at the kernel level, affecting all users with root privileges that can send custom dot commands via the IBM ASM I2O interface.

The exploit requires local root privileges and involves submitting a specially crafted dot command header. There is no publicly disclosed vulnerability exploitation code, the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The impact is limited to the host system and can lead to information disclosure and service desynchronization of the SP. The CVSS score is not provided, but the theoretical severity is high (potentially 9+). Due to the privilege prerequisite, remote exploitation is unlikely without a prior compromise that grants root access.