The vulnerability arises from the vDPA driver for OcteonEP devices incorrectly determining the IRQ index, assuming the first IRQ is always the base. The patch replaces this assumption with a lookup into the hw->irqs array. This bug permits improper ring indexing when IRQ numbers are non‑contiguous, potentially causing an out‑of‑bounds memory access in the kernel. Such memory corruption can lead to a kernel panic or provide a vector for privilege escalation, representing a classic out‑of‑bounds array access flaw.

The affected product is the Linux kernel, specifically the vdpa module that implements virtual device passthrough for OcteonEP hardware. Systems running older kernel builds that include this module and assign non‑contiguous IRQs to the device may be vulnerable. No specific kernel release is listed in the CVE, but the referenced commits indicate the issue was fixed in a recent kernel revision.

The CVSS score is 10, and the EPSS score is <1%, indicating a severe flaw with a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploitation. Nevertheless, the defect allows out‑of‑bounds access in a privileged kernel module. If an attacker can force the driver to process a faulting IRQ sequence—such as via device reset, malformed I/O, or manipulated IRQ configuration—they could trigger a crash or elevate privileges. The most likely attack vector would be local or through a compromised device interface. In the absence of active exploitation evidence, the risk remains high due to the kernel privilege context, making prompt patching warranted.