A flaw in the AHCI driver causes the kernel to crash when the controller’s memory‑mapped I/O region is smaller than the number of ports advertised by the hardware. The driver calculates the required size for all ports and, if the base address register is too small, accesses memory beyond the valid range, leading to a kernel panic. The primary consequence is denial of service by bringing the system down, exposing the affected system to potential physical or local attackers able to manipulate BIOS settings or firmware.

The issue affects any Linux kernel configuration that loads the AHCI driver on hardware where a BIOS may report an incorrect number of ports. The specific kernel versions are not listed in the data, so all kernels prior to the described patch are potentially affected.

The severity is high because a single out‑of‑bounds memory access can crash the kernel, but a formal CVSS score is not provided. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, indicating no publicly known exploits yet. Attackers would likely need local or physical access to modify BIOS or firmware to set a bogus CAP.NP value, making remote exploitation unlikely at present. Nevertheless, the potential for a local denial of service warrants prompt remediation. The fix prevents the panic and gracefully reports the error instead.