The Linux kernel fwctl core allocates an RPC input buffer based on fwctl_rpc.in_len and passes it to a driver callback. The pdsfc_fw_rpc() function casts this buffer to struct fwctl_rpc_pds and calls pdsfc_validate_rpc(), which reads fields from the structure before verifying the buffer size. This sequence allows reading beyond the allocated buffer if the input length is too short. The vulnerability is mitigated by rejecting pds RPC buffers smaller than the struct fwctl_rpc_pds size prior to parsing any pds-specific fields.

The vulnerability could lead to out-of-bounds reads in kernel memory due to insufficient validation of RPC input buffer size. This may cause memory corruption or information disclosure within the kernel context. No known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to validate the RPC input buffer size before parsing pds-specific fields, rejecting buffers that are too small. Users should apply the official kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisories for the exact fixed versions and update accordingly.