The flaw resides in the Linux kernel’s dsa_port_from_netdev() function used by the SJA1105 switch driver. It can return a port that belongs to a different chip, and the driver then uses that port index to program local hardware. If the index exceeds the local chip’s port count, the code performs an out-of-bounds memory access. The impact is limited to this memory read; the description does not claim a crash, denial of service, or more severe damage.

This vulnerability applies to any system running a Linux kernel that includes the dsa_port_from_netdev() implementation for the sja1105 switch driver. All kernels that have not yet adopted the upstream patch before the commit abd7511e12b231798332afa04ed9bee9e84f9445 are potentially affected. No specific kernel version range is listed, so the risk covers any current kernel build that contains the vulnerable driver.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1 % suggests that exploitation is unlikely in the short term. The vulnerability is not listed in CISA KEV. The likely attack vector is a network engineer or attacker who can inject crafted frames that cause dsa_port_from_netdev() to return a cross‑chip port, requiring physical or network access to the switch fabric. Based on the description, it is inferred that the exploit would be limited to an out-of-bounds memory read and would not provide remote code execution or full system compromise.