A buffer overflow exists in the bcm_sysport_get_stats() function of the Linux kernel’s SYSTEMPORT driver. The bug occurs when the driver is compiled for SYSTEMPORT Lite; unsupported statistics are iterated over, and write operations use the wrong index variable, causing data to be written beyond the bounds of the buffer supplied by ethtool. The resulting kernel memory corruption can be leveraged by an attacker to introduce arbitrary data into kernel address space, potentially culminating in arbitrary kernel code execution and full system compromise.

This flaw affects any system running the Linux kernel with the bcm_sysport driver enabled on a SYSTEMPORT Lite adapter. All kernel releases that include the driver and have not applied the documented patch are vulnerable; the fix is present in the commit referenced in the advisory, so versions prior to that commit are at risk.

The CVSS score of 6.7 indicates moderate severity, but the nature of a kernel buffer overflow makes the practical risk high for local attackers. The EPSS score of less than 1% shows low current exploitation probability, and the vulnerability is not yet catalogued in CISA’s KEV list. An attacker would need local access to run ethtool on the affected interface or otherwise interact with the driver. Once written data corrupts kernel memory, the attacker can pivot to execute code with elevated privileges, making this a critical local privilege escalation vector.