In the Linux kernel a flaw in the CXL region driver allows an out‑of‑bounds array access when the driver assumes a valid target index. The index may be set to a negative error code during interleave calculation, causing the code to read through a kernel pointer. This memory corruption can lead to undefined behaviour, potentially enabling an attacker to modify kernel memory or crash the system. The weakness is a classic out‑of‑bounds read, which can be used to elevate privileges or crash services if an attacker can influence the values passed to the driver.

The vulnerability resides in the generic Linux kernel CXL region driver. No specific kernel version range is listed in the CNA data, so any kernel build that includes the affected code path before the patch may be vulnerable.

The CVSS score is 8.4, indicating high severity. The EPSS score is less than 1%, suggesting a low probability of exploitation under current conditions. Based on the description, it is inferred that the likely attack vector is local or privileged‑level, as exploitation would require local privilege or the ability to load and configure the driver. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating that no public exploit has yet been seen, but the high CVSS score and kernel impact mean it remains a serious risk where an attacker can potentially gain elevated privileges or crash the system.