In the Linux airoha network driver, a pointer declared as a 16‑bit unsigned integer array is allocated with only one byte per entry. The verification routine airoha_ppe_foe_verify_entry writes beyond the end of this buffer when the hash value is at least half the number of entries, corrupting kernel memory and causing a crash. Based on the description, it does not appear to provide privilege escalation or data exfiltration.

All Linux kernel releases that include the airoha driver and have not yet incorporated the upstream patch referenced in the commit URLs are affected. Administrators should consult the kernel changelog for the airoha driver to determine if the fix has been applied in the kernel version they use.

The CVSS score of 9.8 indicates critical severity, while the EPSS score of less than 1% suggests low current exploitation activity and the vulnerability is not cited in the CISA KEV catalog. The likely attack vector is via crafted network traffic sent to an active airoha NIC; an attacker can trigger the overflow by invoking airoha_ppe_foe_verify_entry with the appropriate hash value, resulting in a kernel crash that can bring the system down.