The Linux kernel's qnap-mcu driver used an on-stack buffer for replies that was exposed to concurrent writes from the serdev receive path without proper serialization. When a command timed out, the reply buffer still pointed to the stack frame, which could be overwritten by late or unsolicited messages, causing stack corruption. The patch moves the receive buffer into a devm_kzalloc()ed structure associated with the driver, ensuring the buffer remains valid beyond the command timeout and is protected by bus_lock serialization.

Stack memory corruption could occur due to late or unsolicited MCU messages writing into a stack buffer after a command timeout. This could potentially lead to undefined behavior or system instability in the affected Linux kernel driver.

A fix is available that moves the receive buffer from the stack to a dynamically allocated structure that persists for the driver's lifetime, preventing late writes from corrupting stack memory. Users should apply the official Linux kernel update that includes this patch to remediate the vulnerability.