The Linux kernel function rvu_register_interrupts processes every MSI‑X vector and uses the unbounded string search function strstr() to locate substrings such as "Mbox" or "FLR" within each interrupt name. Because the per‑vector NAME_SIZE buffer is not fully initialized before this loop, strstr() continues past the buffer’s end until it finds a NUL terminator, triggering a KASAN slab‑out‑of‑bounds read when debug options are enabled. This flaw does not allow arbitrary code execution but can cause a kernel panic or, more critically, expose sensitive kernel memory contents during system boot. The vulnerability is limited to platforms using the Octeon TX2 architecture and requires boot‑time debugging to trigger. The weakness is an out‑of‑bounds read caused by improper string bounds checking.

This issue affects the Linux kernel on Octeon TX2 hardware platforms. No specific kernel release or version range is listed in the CVE data, so all kernels running on Octeon TX2 with the unpatched rvu_register_interrupts routine are potentially vulnerable. Administrators should verify whether their systems build with debug or KASAN enabled and whether the Octeon TX2 drivers have been updated to the commit that replaces strstr() with strnstr().

Because the flaw only manifests during early boot and requires debug options, the exploitation likelihood is low for most deployments. No EPSS score is available, and the vulnerability is not tracked in the CISA KEV catalog, indicating it is not known to be exploited in the wild. The CVSS score is not provided, so risk should be assessed based on the potential impact of a kernel crash or information leak on a local system. Attackers would need privileged local access to the machine during boot; remote exploitation is not supported by the current data.