The nct6775 kernel module incorrectly counted temperature registers for the NCT6116 hardware monitoring chip, using a six‑element array meant for the NCT6106. This mismatched size caused an out‑of‑bounds read during device initialization, which surfaces as a KASAN fault. The fault can lead to kernel memory corruption and potentially a kernel panic if not handled. The flaw is a classic buffer over‑read in kernel space.

All Linux kernel installations that load the nct6775 driver and contain an NCT6116 chip – typically embedded systems and server motherboards that support this chip. The issue is present in any kernel version prior to the commit that hard‑codes the register count to three for NCT6116. Devices using newer kernels that include the corrective patch are not affected.

The CVSS score is 5.5, and the EPSS score is < 1%. The vulnerability requires local control of the kernel module during device probe and potentially privileged access to the hardware. It is not listed in the CISA KEV catalog, suggesting no known exploitation in the wild. Nonetheless, because it leads to a kernel memory corruption condition, it is advisable to address promptly. The likely attack vector is local privilege or compromised firmware interacting with the hardware monitoring driver.