In the Linux kernel FPGA device driver, a flaw in the dfh_get_param_size() function permits the reported size of a parameter to exceed the bounds of the feature region. The function increments the size before performing a bounds check, so if the End of Parameters bit is set during the same iteration, the inflated size is returned without re‑validation. This erroneous size is then used by create_feature_instance() to copy data via memcpy_fromio(). The code thus attempts to copy more data than the mapped FPGA region contains, which can overwrite kernel memory and potentially lead to privilege escalation, arbitrary code execution, or a denial of service. The issue is a classic bounds‑checking bypass that results in a buffer overrun in kernel space, identified as CWE‑805.

The vulnerability exists in all Linux kernel builds that include the FPGA device driver (DFL) without the patched bounds check. The vendor is the Linux project, and the product is the Linux kernel. No specific kernel versions are enumerated, so any currently running kernel that lacks the fix may be affected.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. However, the flaw is a kernel‑mode buffer overflow, making it highly destructive if triggered. Exploitation requires a malicious or compromised FPGA device that can provide crafted DFHv1 parameter headers and direct interaction with the affected driver. The vulnerability is not listed in CISA's KEV catalog, but the potential impact and the need for a kernel update remain critical.