The remoteproc driver for Qualcomm WCNSS devices incorrectly increments an internal information pointer when handling power‑domain regulators on single‑power‑domain platforms. The increment is mistakenly swapped from the number of regulator entries to the number of power domains, causing the pointer to move past the end of the regulator array on hardware such as SDM632’s pronto‑v3. This out‑of‑bounds memory access can corrupt kernel memory and may trigger the *regulator request with no identifier* error during driver initialization. The description does not claim any denial of service or privilege escalation; it focuses solely on memory corruption.

All Linux kernel releases that contain the unpatched qcom_wcnss remoteproc driver before the commit that introduces the pointer‑increment fix. The bug is observed on devices that use the SDM632 platform and similar Qualcomm processors that consist of a single power domain but expose multiple power domain regulators. No specific kernel version numbers are identified, but any kernel older than the commit that implements the fix is at risk.

The CVSS score of 5.5 classifies this issue as moderate severity. The EPSS score is less than 1%, indicating a very low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The bug requires execution of the remoteproc driver path with a configuration where the power‑domain count exceeds the regulator count, which generally would be triggered during device probe or initialization. Because it constitutes an out‑of‑bounds access in kernel mode, an attacker would need local execution or physical access to the device to exploit it; the description does not assert that remote exploitation is possible. Overall, the risk remains limited to potential kernel crashes or stability issues rather than privilege escalation.