A runtime assertion in the Linux kernel’s CXL firmware controller driver was flagged by Fortify as a potential buffer overflow. The code path referenced the variable @num_entries before it was initialized, creating a false positive warning. The vulnerability does not represent a real memory corruption or privilege escalation; it merely suppresses a defensive check and does not alter functional behavior.

All Linux kernel builds that contain the cxl/fwctl driver before the commit introducing the fix rely on the uninitialized variable, causing the Fortify warning. Kernel packages built after that commit include the corrected initialization and suppress the warning. The affected components are the kernel CXL firmware controller module (cxl/fwctl).

The CVSS score of 5.5 reflects a low to medium impact threshold typical for a false positive, but does not correspond to an exploitable flaw. The EPSS score indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Analysts infer that the likely attack vector would require local privileged access to load or trigger the affected driver, but even then no direct memory corruption or data leakage can be achieved. The lack of a real vulnerability means attack avenues are effectively nil until source code changes introduce a genuine flaw.