An out‑of‑bounds write occurs in the Linux kernel’s MIPS memory‑management code. The function maar_res_walk() indexes a fixed‑size wi->cfg array using wi->num_cfg, but performs the fullness check only after the write has already taken place. If walk_system_ram_range reports more than 16 memory ranges, the write overruns the array boundary by one struct maar_config, corrupting adjacent kernel data. Based on the description, it is inferred that such corruption could lead to privilege escalation or a system crash if an attacker can trigger this path. The patch moves the overflow check before the write, preventing the overrun.

The flaw exists only in the Linux kernel for the MIPS architecture. Any kernel that does not contain the commit that moves the full‑array check before the write is affected. No specific kernel release numbers are cited in the advisory, so operators should examine the running kernel version and compare it to the commit that implements the fix. The affected vendor is Linux; the primary product is the Linux kernel on MIPS.

The EPSS score of < 1% indicates a very low likelihood of exploitation, and the issue is not listed in CISA’s KEV catalog. The CVSS score of 5.5 reflects a moderate level of severity. Exploitation would likely require local or privileged access to code that triggers the memory‑range walking logic, such as during kernel boot or through privileged operations that supply many memory ranges. Based on the description, it is inferred that an attacker must be able to influence the walk_system_ram_range routine. No public exploit is documented, and the theoretical impact is high because kernel memory corruption can compromise entire system integrity.