The vulnerability is an out‑of‑bounds read in the Linux kernel’s CXL (Compute Express Link) subsystem. During fwctl command handling the kernel copies a user‑supplied input buffer but later ignores the length when accessing the operation size. If that size exceeds the allocated buffer, the kernel reads past the end of the buffer, causing a kernel OOPS and crash, which results in a denial of service.

All Linux kernels that include the CXL features are affected. Any distribution that ships a kernel with the CXL subsystem, regardless of vendor, is potentially impacted because the code path in cxl/features is present before the patch. No specific version numbers are listed, so all kernels incorporating this code and not yet patched are vulnerable.

The CVSS score of 4.4 indicates moderate severity. The EPSS score is less than 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, further indicating limited or no active exploitation. The likely attack vector is local access to the CXL interface, such as sending a crafted fwctl command from user space. An attacker with the ability to interact with the CXL device can trigger a kernel crash, which is a denial of service. No privilege escalation or data exfiltration is reported; the impact is confined to service availability.