states_show() uses an unbounded sprintf to write CPU hotplug state names into a single kernel buffer. When the number of registered states grows, the sprintf may write beyond the PAGE_SIZE boundary, corrupting adjacent kernel memory. Such corruption could lead to arbitrary code execution or a denial of service. The flaw falls under buffer overrun weaknesses (CWE-120).

All Linux kernel releases prior to the commit that replaces states_show() with the safe sysfs_emit_at() implementation are affected. The entry does not list specific version numbers, so any kernel version that has not incorporated the fix through the referenced patch commits is considered vulnerable.

The CVSS score is 7.8, and the EPSS score is < 1%. The vulnerability is not listed in CISA’s KEV catalog, indicating no known public exploitation. However, because it occurs in kernel code, the flaw carries high potential severity: an attacker with ability to trigger the sysfs interface could execute arbitrary code or crash the system. The lack of public exploits does not diminish the risk, so the flaw should be treated as a high‑risk kernel bug until mitigation is applied.