The Linux kernel generates /proc/irq/<n>/ directory names by formatting the IRQ number into a fixed 10‑character buffer using sprintf. Ten‑digit IRQ values require 11 bytes including the terminating NUL, causing a single‑byte overflow that can corrupt adjacent kernel memory. This flaw falls under memory safety vulnerabilities (CWE-787) and can lead to a denial of service or, depending on the memory layout, local privilege escalation when the kernel is manipulated while creating or removing the proc entry.

The vulnerability affects any Linux kernel build that accepts ten‑digit interrupt numbers in sparse‑IRQ configurations. The CNA lists the product as Linux:Linux, and no specific kernel versions are enumerated, so the risk applies to all current builds that allow such IRQ values.

The CVSS score of 5.5 indicates moderate severity, while an EPSS score of < 1% signals very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, implying no publicly documented exploits yet. Exploitation requires local access with the ability to configure IRQ numbers or load kernel modules that manipulate the /proc/irq directory. An attacker who can trigger the creation of a 10‑digit IRQ entry could overflow the name buffer and corrupt kernel memory, potentially resulting in a crash or privilege escalation depending on the surrounding memory state.