The vulnerability arises when firmware supplies log indices that exceed the bounds of a kernel‑mode buffer. Because the kernel does not verify the validity of the read and write indices before accessing the buffer, an attacker could induce out‑of‑bounds memory reads or writes, which may lead to data disclosure, corruption or even execution of arbitrary code in kernel context. The weakness is a classic bounds‑checking failure, corresponding to CWE‑119.

Both Linux kernel variants listed as impacted (Linux:Linux) are impacted. Any instance of the kernel that incorporates the ivpu firmware component prior to the patch has this flaw; versions updated to include the commit adding bounds checks are considered fixed.

The exploit requires control over firmware components or the ability to supply malicious log indices, typically only feasible with privileged or firmware update access. The absence of remote exploitation vectors and the lack of a known public exploit reduce the likelihood of immediate attacks. The CVSS score is not provided, EPSS is unavailable, and the issue is not in the CISA KEV catalog, indicating a moderate but not high risk to unpatched systems. Upon patching, the risk is effectively eliminated.