The flaw is an unbounded copy in the staging vme_user helper functions. The buffer_to_user() and buffer_from_user() functions copy 'count' bytes into or out of a fixed 128 KiB kernel buffer without limiting the combined offset and count against that buffer size. If a VME window larger than 128 KiB is configured, a read or write can copy beyond the buffer, corrupting kernel memory.

This issue is present in the Linux kernel for all releases that ship with the vme_user staging driver. The driver itself is part of the staging tree, so any distribution that includes the stock kernel contains the vulnerable code. No specific version ranges are listed; the fix is included in recent kernel updates.

The CVSS score of 7.8 indicates a high severity. The EPSS score is less than 1%, and the vulnerability has not been reported in the CISA KEV catalog, suggesting a low likelihood of active exploitation. Exploitation requires interacting with the /dev/vme_user device, and succeeds only when the attacker can provide a VME window size larger than the internal buffer and has permissions to write to the device. If used successfully, the out-of-bounds write can corrupt kernel memory, potentially enabling privilege escalation. This consequence is inferred from the nature of the buffer overflow; the CVE description does not confirm exploitation results.