In the Linux kernel on powerpc/pseries, the function papr_phy_attest_create_handle() fails to validate the cmd.length field before using it, which can lead to a buffer overflow. The overflow could allow an attacker to overwrite kernel memory and execute arbitrary code with elevated privileges. Additionally, the function forgets to free the params structure on error paths, leading to a memory leak. The identified weakness is reflected in CWE‑805. The likely attack vector is local exploitation via a privileged or userland interface that triggers papr_phy_attest, as the bug resides in kernel code. This inference is made because the function is only reachable through kernel‑level operations and the CVE description does not specify an external interface.

The flaw affects the Linux kernel on all powerpc/pseries builds that include the papr_phy_attest code path. Because the vendor list identifies the Linux kernel as the affected product, any kernel image compiled for powerpc/pseries that has not incorporated the upstream fix is potentially vulnerable. No specific version numbers are listed, so the attack surface extends across all releases until the patch is applied.

The CVSS score of 7.0 suggests a high impact vulnerability. Given the EPSS score is less than 1%, public exploitation is unlikely at present, and the vulnerability is not in CISA’s KEV catalog. The likely attack vector is local exploitation via a privileged or userland interface that triggers papr_phy_attest; it is inferred that an attacker would need local access or a previously authenticated process to invoke this code. If the code is reachable from a user process, the overflow could lead to privilege escalation to root. Proper defensive coding or disabling the feature mitigates the risk.