During initialization of the tc9563 PCI power‑controller driver the kernel incorrectly parses the integrated Ethernet MAC Endpoint node, acquiring configuration registers for both physical functions. The parsing logic directly accesses the tc9563_pwrctrl->cfg array and, when both functions are parsed, the address calculation can slip past the end of the array, producing an out‑of‑bounds read. The read may expose kernel data to a caller that can exercise this path, and the CWE‑787 weakness indicates that the exposed memory could be leveraged for further exploitation. The description does not state an attacker model; it is inferred that the vulnerability can be triggered whenever the driver is loaded and the parsing routine executes, which typically requires local access to the system or the ability to load the kernel module.

All Linux kernel releases that include the legacy tc9563 PCI/pwrctrl driver before the commit that introduces the patch. The affected component is the kernel module named tc9563_pwrctrl, which is part of the Linux kernel’s PCI power‑control subsystem. No specific kernel versions are enumerated, so any kernel version containing the unpatched driver is vulnerable.

The CVSS score of 7.7 categorizes this as high severity, while an EPSS score of less than 1% indicates a very low yet non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. It is likely that an attacker would need to load or otherwise interact with the tc9563 driver to trigger the parsing routine, suggesting a local or privileged execution model, though this is an inference drawn from the nature of driver initialization. Successful exploitation could leak kernel memory and potentially enable privilege escalation within the host.