The Linux kernel forcedeth driver contained an off-by-one error in nv_suspend() and nv_resume() functions that walk the non-PCI configuration space array with a loop condition allowing one iteration beyond the array length. This causes out-of-bounds access to memory immediately following the array, specifically to np->name_rx. Although no data corruption occurs because name_rx is overwritten before use, the out-of-bounds access triggers UBSAN warnings and can cause kernel aborts if UBSAN traps are enabled. Additionally, an MMIO read and write occur one dword past the mapped register space. This vulnerability was fixed by changing the loop condition from '<=' to '<' to ensure exactly register_size bytes are saved and restored without overflow.

The vulnerability causes out-of-bounds memory access leading to potential kernel crashes when UBSAN traps are enabled. It also results in an out-of-bounds MMIO read and write, which could cause undefined behavior in hardware interaction. However, no direct data corruption or security breach has been observed. The issue primarily affects kernel stability under specific configurations (UBSAN enabled).

A patch fixing the off-by-one error by changing the loop condition from '<=' to '<' has been applied in the Linux kernel source. Users should update to a kernel version that includes this fix. If running a kernel with UBSAN enabled and encountering crashes related to forcedeth, upgrading is recommended. No additional mitigation is required beyond applying the official fix.