The Linux kernel's caif subsystem contained an integer underflow vulnerability in the cffrml_receive() function. This function extracts a length field from a packet header and subtracts 2 from it if FCS is disabled, without validating that the length is at least 2. An attacker sending a packet with length 0 or 1 can cause the subtraction to underflow, leading to memory exhaustion and kernel instability. Additionally, this may expose uninitialized kernel memory, resulting in potential information disclosure. The vulnerability has been resolved by adding a validation check to ensure the length is at least 2 before performing the subtraction.

Exploitation of this vulnerability can lead to denial of service through memory exhaustion and kernel instability. There is also a risk of information disclosure due to exposure of uninitialized kernel memory contents. The CVSS v3.1 vector indicates high confidentiality impact and high availability impact, with no privileges required and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is confirmed, avoid disabling FCS on affected interfaces as a temporary mitigation. Monitor vendor channels for updates and apply patches once available.