The vulnerability arises from the TPM 2.0 driver function tpm2_load_cmd() not correctly checking the size of the payload it is about to load, a buffer overflow weakness (CWE‑125). The boundary checks rely on an ASN.1 size field that can be manipulated, allowing an attacker to provide a larger data blob than the check permits. If an attacker supplies such a payload, the unchecked memory copy can overflow the kernel buffer, leading to arbitrary code execution or privilege escalation at the kernel level.

All Linux kernel distributions are potentially affected, including those listed under Linux:Linux. The specific version ranges are not disclosed in the advisory, so any kernel that includes the unpatched tpm2_load_cmd() implementation should be considered vulnerable until a patch is applied.

The risk level is high given the potential for kernel memory corruption. The EPSS score is reported as less than 1 %, and the vulnerability is not listed in the CISA KEV catalog, indicating a low but measurable probability of exploitation but no widespread exploitation documented. The most likely attack vector is a local user with access to the TPM device, or compromise of software that interacts with the TPM. The kernel must be patched to fix the check of the decoded blob size.