A heap out‑of‑bounds write occurs in the Linux kernel driver ‘accel/ethosu’ when processing 64‑bit commands. The parsing loop increments the index a second time for commands with bit 14 set but does not verify that the new index remains within the buffer bounds before writing the second word. This unchecked write corrupts the kernel‑heap memory backing the buffer, allowing a user to overwrite arbitrary kernel data and potentially gain higher privileges or crash the system.

The vulnerability affects any Linux kernel that includes the legacy ‘accel/ethosu’ driver before the commit that introduced the bound check. No specific kernel releases or version numbers were listed in the advisory, so all builds that ship with the vulnerable driver are potentially impacted.

The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. Kernel OOB writes are typically considered high‑risk because they directly affect kernel memory. The attack vector is local: a regular user with access to the device node (for example, /dev/ethosu or the DRM device) can trigger the ioctl that supplies the command stream. Because the exploit controls both the buffer contents and the size parameter, it can be crafted without privileged input. The lack of a publicly known exploit does not reduce the potential severity of the vulnerability.