An integer overflow in the __nd_label_validate() function of the libnvdimm subsystem causes the product of the on‑media namespace index field nslot and the label size to wrap in 32‑bit arithmetic, allowing a crafted index to pass a bound check during namespace label initialization. This failure permits a loop count to exceed the size of the configuration buffer, resulting in an out‑of‑bounds write. The field nslot is sourced from medium storage or from userspace via ND_CMD_SET_CONFIG_DATA, so any malicious or malformed input may trigger the overflow. The resulting kernel memory corruption could lead to privilege escalation or denial of service.

The vulnerability affects all Linux kernel builds that include the libnvdimm subsystem before the 64‑bit bound check introduced in commit 564e871. Kernel configurations that enable NVDIMM handling are potentially impacted. The CVE data does not list any specific affected kernel versions, so all builds incorporating libnvdimm without the patch may be vulnerable.

The CVSS score of 6.0 denotes a medium severity vulnerability. EPSS score is less than 1%, indicating a very low exploitation probability, and the flaw is not listed in the CISA KEV catalog. Exploitation would likely require local access to the system or a user that can issue NVDIMM configuration commands. The potential for kernel memory corruption makes this a noteworthy risk, but current data does not indicate that the vulnerability is actively exploited in the wild.