This vulnerability originates in the Linux kernel’s PCI subsystem where the ROM header and data structure addresses are not validated before access. The missing checks allow an out-of-bounds read of an unmapped region or misaligned address, which results in a kernel page fault and a crash. The impact is a denial of service, as the kernel terminates the offending process or the entire system can become unstable if invoked by privileged or kernel processes. The weakness is a classic out-of-bounds read (CWE‑125).

Linux kernel releases prior to the fix (any version containing the unvalidated PCI ROM access code) are affected. The issue manifests on both x86_64 and arm64 architectures, as shown by crashes triggered by stress-ng or generic PCI access attempts. Vendors that ship kernels without the beyond‑check patch are impacted, while newer kernel releases that include the header and alignment validation are not.

The vulnerability is local and requires interaction with a PCI device that presents a corrupted or misaligned ROM area. The exploit does not require code execution beyond an out-of-bounds read, so an attacker cannot directly execute arbitrary code, but can force a system crash. The EPSS score is not available, and the vulnerability is not currently listed in CISA’s KEV catalog, suggesting no publicly known exploitation to date. Nonetheless, the critical nature of a kernel crash warrants immediate attention, and the risk is higher on systems that regularly perform PCI device enumeration or firmware updates that might trigger erroneous ROM reads.