This vulnerability occurs in the Linux kernel's ims‑pcu driver, which processes response data from device buffers without verifying that the device has supplied the expected amount of data. The lack of length checks can cause the driver to read beyond the bounds of the input buffer, resulting in out‑of‑bounds reads or the processing of stale data. Such reads may expose sensitive kernel memory contents to an attacker or cause denial of service conditions by corrupting internal state.

The flaw is present in the Linux kernel wherever the ims‑pcu driver is active. Affected versions include all kernel releases prior to the applied patch that adds the missing response length checks; no exact version list is provided, so any distribution using the kernel without the fix is at risk.

The CVSS score of 5.5 indicates moderate risk, and the EPSS score is < 1%. The flaw is not listed in CISA’s KEV catalog. The likely attack vector requires local or privileged access that enables interaction with the ims‑pcu device, allowing an attacker to manipulate the device’s response payload to trigger the out‑of‑bounds read. While the vulnerability only allows information disclosure or potential denial of service, it could serve as a stepping stone for higher‑level compromise if an attacker already has local or device‑level control.