An out-of-bounds read in the NCSI subsystem allows an attacker who can send netlink commands with the CAP_NET_ADMIN capability to read up to approximately 64 KB of kernel heap memory. The bug occurs when the NCSI payload length field in the packet header is larger than the actual data attribute size, leading to a leak of kernel memory contents through the transmitted NCSI command packet. The exposed data is not executable code, so remote code execution is not possible, but the leak can undermine confidentiality of sensitive kernel information.

The flaw exists in any Linux kernel where the NCSI driver is compiled with NET_NCSI=y, a configuration that is common on OpenBMC firmware running on Aspeed BMC System-on-Chip platforms. It is not tied to a particular vendor beyond the Linux kernel itself, and no specific kernel version is listed. Users should consider that any kernel build before the patch may be vulnerable if NCSI is enabled.

Because the vulnerability is an information‑lookup flaw that requires CAP_NET_ADMIN, the exploit path is limited to privileged users who can send arbitrary netlink commands to the NCSI driver. No publicly available exploits are documented, and the EPSS score is < 1%. The vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 5.5 indicates a moderate risk level. Although the potential impact is limited to confidentiality loss of kernel heap data, the availability of the exploit and the lack of widespread exposure make the risk lower than a remote code execution; however, for exposed systems using NCSI, it warrants immediate remediation.