In the Linux kernel, the function spufs_mem_mmap_access() incorrectly calculates the local store offset by checking against the wrong boundary. When executing on 64-bit PowerPC, the read length is not clamped, allowing a read that exceeds the LS_SIZE buffer. This out-of-bounds read can expose kernel memory contents to an attacker who can map the spufs device, leading to possible information disclosure.

The flaw exists in the Linux kernel for PowerPC (powerpc/spufs). No specific kernel release range is listed, so any kernel build that includes the unpatched spufs code on a PowerPC platform may be affected. Administrators should verify whether their system runs a patched kernel that includes the change in commit 3c1e92f.

The weakness is an improper bounds check (CWE-125). Because the payload is a read, there is no direct code execution path, and the vulnerability has not been catalogued in the CISA KEV list, nor is there an EPSS score. An attacker would likely need local or privileged access to map the spufs device; thus the attack vector is inferred to be local. Given the lack of exploitation data, the risk is moderate, but the potential to leak sensitive kernel data warrants immediate attention.