The Linux kernel's stm32 CEC driver function stm32_rx_done() appends received CEC bytes to a fixed-size buffer using an index that is incremented on each receive-byte-ready interrupt without checking if it exceeds the buffer size (16 bytes). Because the remote CEC device controls the message length, it can send more bytes than the buffer can hold, causing an out-of-bounds write into adjacent memory. The existing length check occurs after the write, so it does not prevent overflow. The fix bounds the index before storing bytes, dropping excess bytes, aligning with other platform CEC drivers.

This vulnerability allows a remote device on the CEC bus to cause an out-of-bounds write in kernel memory, potentially leading to memory corruption. The flaw is exploitable without local privileges and can be triggered during normal operation once the driver is active. No specific exploit or active in-the-wild usage is reported. The impact could include system instability or potential escalation depending on the memory corruption consequences.

A fix is available that adds bounds checking before writing received bytes to the buffer, preventing out-of-bounds writes. Users should apply the official Linux kernel update that includes this patch. Until patched, disabling or restricting CEC functionality on stm32 devices may reduce exposure.