The Linux kernel contains a flaw in the ptp OCP subsystem where the EEPROM board ID, a fixed 13‑byte field that is not guaranteed to be NUL terminated, is passed directly to a function that treats it as a C string. This can cause a buffer over‑read when the data contains non‑terminating characters, exposing adjacent kernel memory to the caller. The vulnerability is a classic buffer over‑read (CWE‑126) and also falls under invalid input handling (CWE‑20).

The issue is present in the Linux kernel source. All kernel versions that include the ptp OCP board ID handling before the patch are potentially vulnerable. Because specific version ranges are not listed, any kernel built from the mainline repository prior to the application of the commit that introduces a precision limit and copies only OCP_BOARD_ID_LEN bytes may be affected.

The flaw allows a privileged user or an attacker with access to the devlink subsystem to read arbitrary memory adjacent to the board ID buffer. While code execution is not directly granted, the exposure of kernel memory could aid in side‑channel analysis or lead to further attacks. The EPSS score is not available, and the problem is not listed in the CISA KEV catalog, suggesting limited current exploitation activity but still warranting prompt mitigation.