In the Linux kernel, the function spufs_mem_mmap_access() incorrectly calculates the local store offset by checking against vma->vm_end instead of the actual local store size, which for 64‑bit PowerPC systems always exceeds the intended bound. The calculation fails to clamp the read length, allowing the kernel to read past the LS_SIZE buffer returned by ctx->ops->get_ls(). This out‑of‑bounds read can expose kernel memory contents to anyone who can map the spufs device, thereby leaking sensitive data. The weakness is a classic bounds‑check failure (CWE‑787).

The flaw exists in the Linux kernel for PowerPC (powerpc/spufs). Any kernel build that includes the unpatched spufs code is affected; no specific kernel release range is listed. Administrators should verify whether their system runs a patched kernel that includes the change in commit 3c1e92f and conforms to the Linux:Linux vendor/product identification in the CPE namespace.

The CVSS score of 7.8 indicates high severity, but the EPSS score of <1% reflects a very low probability of exploitation. The vulnerability is not catalogued in the CISA KEV catalog. The exploit would almost certainly require local or privileged access to map the spufs device, making it an inferred local attack vector. While exploitation is currently unlikely, the potential to leak kernel data warrants proactive attention.