In the Linux kernel idpf driver, an array of interrupt vector values is populated from a control plane reply. The copy loop is bounded only by the per‑chunk vector count, while the overall buffer size comes from the advertised number of allocated vectors. If a reply’s per‑chunk totals exceed the advertised count, the driver writes past the end of the caller‑allocated array, producing a KASAN slab‑out‑of‑bounds write. This memory corruption can crash the kernel or be exploited for privilege escalation.

All Linux kernel installations that include the idpf driver before the patch that bounds the fill loop are vulnerable. The defect affects systems running Intel virtual functions via the idpf driver on any architecture supported by the driver, particularly environments where a hypervisor or control plane supplies the VIRTCHNL2_OP_ALLOC_VECTORS reply.

The flaw manifests as an out‑of‑bounds write, a high‑severity kernel memory corruption. Exploitation requires a specially crafted reply from a control plane or hypervisor; thus the threat is primarily against virtualized environments with untrusted control planes. EPSS data is unavailable and the vulnerability is not listed in CISA KEV, implying no widespread exploitation yet. Nevertheless, the lack of bounds checking allows a privileged attacker to trigger a kernel panic or hijack kernel execution, making this a critical risk for affected systems.