The Linux kernel’s Tegra CBB fabric component contains an error in the calculation of array boundaries during a target timeout lookup, using an incorrect ARRAY_SIZE macro. This flaw permits the code path to read or write past the end of a fabric lookup table, resulting in kernel memory corruption that can cause crashes or denial of service. Based on the description, it is inferred that an attacker could potentially subvert kernel integrity by exploiting the out‑of‑bounds access.

The vulnerability affects the Linux kernel on Tegra platforms that include the CBB fabric module and have not yet incorporated the upstream fix (commit 5c009a5f8bb3c81f2cfb511701ce571e3c8733cd). No specific kernel release range is documented, so any install running legacy Tegra kernels should verify that the patch has been applied or that the offending module is not loaded.

The CVSS score of 7.1 indicates moderate to high severity, while an EPSS score of less than 1% shows a very low current likelihood of exploitation. The vulnerability requires local access to reach the improperly calculated array indices, making remote exploitation unlikely. The CVE is not listed in the CISA KEV catalog, but the kernel memory corruption potential warrants prompt remediation.