The vulnerability arises from an off‑by‑one error in the boundary check for two 4×4 tables used in DP swing configuration within the qmp‑usbc driver of the Linux kernel. The code allows an index value of four, which is outside the allowed range of zero to three, causing out‑of‑bounds array access. The out‑of‑bounds read or write can corrupt adjacent memory, potentially leading to a kernel crash or unexpected behavior. An attacker may exploit this flaw by providing input that triggers the DP swing configuration routine, such as through a USB‑C device or component that interacts with the driver. (The attack vector is inferred from the description because the exact trigger mechanism is not explicitly stated.)

The affected software is the Linux kernel. No specific kernel version range was provided, so any kernel containing the buggy qmp‑usbc driver before the published patch is potentially impacted. The vendor is Linux.

The EPSS score is less than 1 %, and the vulnerability is not listed in the CISA KEV catalog, indicating a currently low likelihood of exploitation. The CVSS score is 7.1, indicating moderate severity. The flaw requires an attacker to trigger the DP swing configuration routine, which likely involves a USB‑C device or a system component interacting with the qmp‑usbc driver. Because the trigger is not publicly documented, the exact attack surface is uncertain; the most probable scenario is local exploitation with device insertion. The out‑of‑bounds access can lead to denial‑of‑service by causing a kernel crash or other instability. No evidence supports that exploitation could lead to privilege escalation.