In the Linux kernel, the aspeed LPC snoop driver uses a kfifo buffer that is accessed concurrently by an IRQ handler and a file read operation. Without synchronization, the producer can advance the input pointer while the consumer advances the output pointer, creating a race condition on SMP systems. This enables the difference (in - out) to exceed the ring buffer size, causing kfifo_copy_to_user to copy more data than the 2‑K backing store. The resulting overflow exposes kernel memory and triggers a kernel BUG, potentially leading to a crash or exposing sensitive memory.

Any Linux system that includes the Aspeed LPC snoop driver before the patch commits 131ab677b03349a5ae48da8722ec7075b37ec66e or 1acef6d85bfd98bd9dfe1f08bffa397a4dda8a6f is affected. The issue is relevant to symmetric‑multiprocessing machines where the IRQ handler and file read can run in parallel. No specific kernel version is listed; the fix is present in downstream stable kernels following the mentioned commits.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of <1% suggests a low probability of exploitation. The flaw is not listed in the CISA KEV catalog. Local attackers with the ability to read the snoop device could trigger the overflow, potentially causing a kernel panic or exposing sensitive memory. Remote exploitation appears unlikely because the driver is accessed locally. Overall, the risk is moderate, and prompt action is recommended.