A boundary check bug in the Linux kernel's mtd: rawnand driver function nand_select_target() allowed the internal variable cs to reference target indices outside the valid range, resulting in an out-of-bounds memory access that could corrupt kernel data structures or memory. This flaw can lead to denial of service or privilege escalation, classified as an out-of-bounds buffer access (CWE-1285).

The vulnerability affects all Linux kernel installations that contain the mtd: rawnand driver before the commit that introduced the boundary check. Any distribution or custom kernel that has not incorporated that patch, regardless of version, is susceptible. The CNA vendor and product specified is Linux:Linux, indicating all Linux kernels.

The CVSS score of 7.8 indicates high severity, and the EPSS score of <1% suggests low exploitation probability. The flaw can cause out-of-bounds memory access in kernel mode and may lead to denial of service or privilege escalation. Exploitation would likely require local or privileged access to manipulate the NAND driver; no public exploits have been reported and the vulnerability is not listed in CISA KEV catalog. Until a patched kernel is deployed, the safest mitigation remains applying the update or removing the vulnerability from the system.