The flaw occurs during the population of the power supply array in the Linux kernel. When the device tree contains multiple power‑supply entries, the code accesses the array element at index i‑1 in __power_supply_populate_supplied_from, which can reference memory beyond the allocated bounds. This out‑of‑bounds memory write corrupts kernel memory, which an attacker could exploit to crash the system or, in some cases, gain higher privileges. The vulnerability is a classic buffer overrun of the supplied_from array.

All Linux kernel builds that include the power supply core code and have not yet applied the patch commit 14357ba0. The fix applies to the kernel source tree regardless of distribution, so any running kernel derived from the affected source is potentially impacted.

EPSS score is < 1 % and the vulnerability is not listed in KEV, but the nature of the bug—an unchecked array index that writes outside its bounds—makes it a high‑severity issue. The CVSS score is 7.0, indicating a high severity level. In the absence of specific exploitation barriers, a local attacker could trigger the overrun by loading a malicious device tree or manipulating a device that supplies power to the system, leading to a kernel panic or arbitrary code execution. The elevated risk merits immediate attention.