The cxl/test module in the Linux kernel contains a runtime assertion within the setup_xor_mapping() function that triggers the __fortify_panic path when the @nr_maps counter is not initialized early enough. The assertion was flagged as a potential buffer overflow on the xormaps array, but the fix introduces an earlier initialization of @nr_maps, preventing the false positive and the unnecessary kernel panic. This modification stabilizes kernel operation but does not add new functionality or security features.

Linux kernel versions that contain the cxl/test module prior to the commit that initializes @nr_maps are vulnerable. The fix resides in the official kernel tree and is included in releases following the referenced commits; any kernel lacking this change may still load the vulnerable module.

The CVSS score of 5.5 denotes medium severity, while the EPSS score of < 1% indicates a very low probability of exploitation. It is not listed in CISA's KEV catalog. Based on the description, it is inferred that the vulnerability could be triggered during module initialization or load when a malformed state occurs, but no explicit exploit path is provided. The potential impact is system downtime from a kernel panic rather than code execution or data compromise.