In the Linux kernel, an integer overflow in the QRTR packet handler allows a crafted packet to cause memory corruption and trigger a kernel crash. The overflow occurs when the size field, taken directly from the packet, is aligned on a 32‑bit boundary, wrapping to zero for large values. The kernel then copies data past the allocated buffer, leading to a kernel oops. The vulnerability is limited to 32‑bit builds; 64‑bit kernels are unaffected.

Affected systems are 32‑bit Linux kernels that include the QRTR subsystem. No specific kernel version is listed in the CVE; the issue persists in any kernel where the unpatched qrtr_endpoint_post() function is present. Users of older or custom kernels without the commit that introduces this guard remain vulnerable.

The vulnerability provides a denial‑of‑service condition for the local system, as an attacker can send an oversized QRTR packet and force a kernel oops. The CVSS score of 8.4 indicates high severity. The EPSS score is less than 1%, implying a low likelihood of exploitation. The CVE is not listed in CISA’s KEV catalog, indicating no known wide‑scale exploitation to date. The likely attack vector requires the ability to inject traffic to the QRTR interface, which is typically a local inter‑processor communication channel; thus the threat is primarily local or requires elevated privileges, but could be triggered by compromised processes with access to the relevant interface.