This vulnerability arises in the Linux kernel’s resctrl subsystem. When a monitoring domain with System‑Node‑Cores (SNC) enabled is offlined, the architecture updates its cpu_mask to empty and calls the limbo handler. The handler then reads the RMID array for a logical RMID that has been converted to a physical RMID using a NUMA node lookup. Because the domain’s cpu_mask is empty, the cpu_to_node() call receives an index equal to nr_cpu_ids, which is outside the valid range and causes an out‑of‑bounds read in the RMID array. The overflow can corrupt kernel data or result in a crash. This flaw is a classic out‑of‑bounds array read (CWE‑125).

All kernel builds that implement the resctrl filesystem and enable SNC support are susceptible. The CVE does not list specific kernel releases, so any distribution kernel containing this code is considered vulnerable until the fix is applied.

The CVSS score of 5.5 indicates medium severity, while the EPSS score of less than 1 % reflects a low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been observed. Exploitation would require an actor able to trigger offlining of a CPU in a monitoring domain, a privileged operation. No evidence of remote exploitation is present, and the primary consequence is a kernel crash leading to denial of service.