The fwctl subsystem allocates an RPC input buffer sized based on a caller‑provided length. The driver immediately casts this buffer to a fwctl_rpc_pds structure and reads its fields before verifying the length is sufficient. A small in_len can cause the driver to read past the allocated memory, leading to a buffer overread that may expose arbitrary kernel data. The vulnerability was corrected by rejecting RPC buffers smaller than the fwctl_rpc_pds structure before parsing any PDS‑specific fields.

All Linux kernel releases that contain the fwctl subsystem without the input‑size validation patch are affected. Any system that runs an unpatched kernel and exposes the fwctl interface, either through built‑in modules or external drivers, is susceptible. No specific version list is supplied, so the safest assumption is that all kernels prior to the commit that introduced the fix are vulnerable.

The EPSS score is reported as < 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating a low probability of widespread exploitation. The flaw can be exercised by sending malformed RPC requests to the fwctl interface. Based on the description, it is inferred that exploitation would require local system access or privileged execution because the interface is typically only reachable by privileged processes. The attack does not appear to support remote exploitation. The information disclosed could aid a privileged attacker or support further privilege escalation, but no direct execution flaw is present.