A flaw in Linux kernel’s firmware loading routine for the elan_i2c driver allows the system to read memory beyond the bounds of a supplied firmware file. The driver assumes that the firmware blob is at least as large as the number of pages plus the signature, but the size check is omitted, so an attacker could supply a malformed firmware that causes the driver to access memory beyond the file’s end. This out-of-bounds read (CWE-125) could lead to disclosure of kernel memory contents, which in turn could reveal sensitive data or serve as a foothold for more advanced attacks such as privilege escalation or exploitation of other kernel vulnerabilities.

All Linux kernel releases that contain the elan_i2c driver and were deployed prior to the patch in this advisory are vulnerable. The affected versions include Linux kernel 7.1 RC1 through RC5. The vulnerability affects the core Linux kernel; no specific hardware vendors or kernel variants are singled out, so any distribution or custom build that includes the unpatched kernel is impacted.

The CVSS score of 7.1 indicates high severity, with the risk primarily tied to local privilege or device-level access. The EPSS score remains below 1%, suggesting a very low probability of exploitation at the present time, and the vulnerability is not listed in the CISA KEV catalogue. The description states that a crafted firmware blob could cause the elan_i2c driver to read memory beyond the bounds of the file. The likely attack vector, based on the description, is an attacker providing such a malformed firmware to the driver, which would trigger the out‑of‑bounds read and potentially expose kernel memory. The actual impact of the read depends on the memory contents accessed; it could reveal sensitive data or serve as a foothold for more advanced attacks, but this is an inferred possibility not explicitly confirmed in the advisory.