The kernel's greybus module incorrectly concatenates incoming serial device data into a fixed‑size receive buffer without checking that the combined length fits the buffer. This flaw could allow attackers to overflow the buffer, leading to arbitrary memory corruption or code execution. The vulnerability was addressed by adding bounds checks before copying data.

The issue affects Linux kernel builds that include the greybus driver, which is used on BeaglePlay and similar devices. No specific kernel versions are listed, but any kernel that incorporates the buggy cc1352_bootloader_rx implementation is susceptible.

The defect is a classic buffer overflow (CWE‑120). The exploit requires the ability to send crafted data over the bootloader UART interface, which could be via local physical access or compromised firmware control. No public exploit has been reported and the EPSS score is not available, so the likelihood of exploitation remains uncertain. The vulnerability is not listed in the CISA KEV catalog.