A kernel out‑of‑bounds write occurs in the MIPS mm code path that processes memory ranges. The function uses a fixed‑size array but only checks capacity after writing to an entry. When the underlying walker reports more than sixteen ranges, the call writes beyond the array boundary and then triggers a WARN_ON() that stops the counter from advancing. The write can corrupt kernel memory, potentially enabling an attacker to modify internal structures or control data. According to the description, the flaw is a simple corruption that could lead to privilege escalation or denial of service if the attacker has sufficient code execution or local access to invoke the vulnerable path.

The vulnerability appears in the Linux kernel’s memory management subsystem for MIPS architecture. All kernel releases that were affected by this out‑of‑bounds write—before the patch that moved the full‑array check up—are vulnerable. No specific kernel versions are enumerated in the data, so it applies to all affected kernel releases until the commit that implements the fix.

The CVSS score is not supplied, and the EPSS score is unavailable, so the quantitative likelihood of exploitation is uncertain. The vulnerability is not listed in the CISA KEV catalog. Based on the nature of the flaw, exploitation would require an attacker to invoke the maar_res_walk() path, which may be triggered by certain privileged operations such as memory management or boot‑time configuration. If an attacker can control the number or ordering of memory ranges, the overflow can corrupt kernel memory. The absence of a documented public exploit means the risk is theoretical, but the potential impact (privilege escalation or possible system compromise) is high.