The Linux kernel contained an off‑by‑one error in the tty hvc_iucv subsystem. The number of supported devices could be set to 8, while the array that stores device pointers only has 8 entries, indexed 0–7. When the code uses the device count as an index, it can read or write past the end of the array. This out‑of‑bounds access can corrupt kernel memory, potentially causing a system crash or allowing local privilege escalation to root. The flaw is a classic buffer overrun scenario that affects kernel stability and security.

All Linux kernel implementations that contain the unpatched hvc_iucv driver configuration are affected. The issue exists in any release that compiled the hvc_iucv module without the patch. No specific version numbers are supplied, but the bug was addressed in the kernel commits referenced in the advisory and is present in the default kernels shipped with most distributions until the patch is applied.

The vulnerability’s CVSS base score is 5.5, which places it in the medium severity range. The EPSS score is less than 1 %, indicating a very low probability of exploitation at the time of this assessment, and it is not listed in CISA’s KEV catalog. The likely attack vector is local kernel exploitation, requiring the attacker to execute code with kernel privileges or to transition from a user process that can interact with hvc_iucv devices. No publicly known exploit exists, but the out‑of‑bounds array access could corrupt kernel memory and lead to kernel crashes or privilege escalation.