The Linux kernel mmp_pdma driver mistakenly reads the length of each scatter‑list entry from the list head instead of the current entry when preparing a DMA transfer. This causes the data length used for each transfer to be based on the first element, so if later elements are shorter the driver reads beyond the intended bounds, leaking kernel memory, and if they are larger the driver silently truncates data. The flaw can lead to information disclosure or corruption of data transmitted by the device.

The vulnerability exists in the mmp_pdma component of the Linux kernel, as indicated by the CPE string for all kernel releases. Any kernel build that includes this driver before the fixed commit is affected; the patch does not specify a version range beyond the general inclusion of the driver. Systems running unpatched kernels with the mmp_pdma driver in use are thus at risk.

The EPSS score is less than 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 7.0 reflects moderate severity. Based on the description, the likely attack vector is local privileged or kernel‑mode access that can invoke the mmp_pdma DMA routine; this typically requires exploitation of a device driver or root access. The risk of successful exploitation is low under normal conditions, but the potential impact of memory disclosure or data corruption justifies prompt patching.