The vulnerability arises from a missing bounds check in the accel/qaic resp_worker function, allowing a maliciously crafted wire message from a connected device to trigger an out‑of‑bounds read. The read can access beyond the allocated slab, potentially causing memory corruption, infinite loops, or a kernel panic. The main consequence for the system is a denial of service through kernel crash, which also disrupts all running processes and can lead to data loss or instability.

The vulnerability affects the Linux kernel across all distributions that include the accel/qaic driver. No specific kernel version or distribution was listed in the CNA data; therefore any installation that uses the accel/qaic interface should be considered vulnerable until the kernel is updated to incorporate the commit that restores the bounds checking.

The CVSS score of 5.5 indicates a medium severity impact, while the EPSS score of less than 1% suggests a low probability of exploitation in the current landscape. The vulnerability is not listed in the CISA KEV catalog, implying that no known widespread exploitation has been documented. The flaw requires a device to send a malformed wire message, thus limiting the attack surface to scenarios where the attacker can control or compromise the hardware that communicates via accel/qaic. Even with this limited vector, a kernel panic can still lead to a denial‑of‑service, so applying a patch remains the recommended response.