The Linux kernel’s AIX partition parser contains an out‑of‑bounds read that occurs when the parsed pp_count field, read directly from the disk header, exceeds the statically allocated ppe array size of 1,016; a maliciously crafted AIX image can therefore cause the kernel to read beyond the bounds of the allocated structure, potentially exposing kernel memory contents to the user space.

Any Linux kernel that has not yet received the patch addressing this flaw is vulnerable; the issue surfaces during the partition detection code path invoked by msdos_partition(), which runs automatically when a block device exposes a malformed AIX partition table—this can happen through user‑initiated loopback device attachment (losetup) or via automated device discovery by udev.

With a CVSS score of 7.1 the severity is high, yet the EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating a low likelihood of exploitation in the wild; an attacker would need to supply a crafted AIX image to a block device that the system scans, which requires local access or ability to influence udev rules. Because the flaw only permits an out‑of‑bounds read, it does not provide a vector for code execution but can leak privileged kernel data, posing a serious confidentiality risk.