The Linux kernel's aix_partition() function reads the physical volume descriptor (pvd) into a fixed-size struct containing a physical-partition-extent (ppe) array of 1016 entries. However, it uses an unvalidated pp_count field from the on-disk descriptor to iterate over the ppe array, which can be up to 65535, leading to out-of-bounds reads beyond the allocated array. This vulnerability can be triggered when a crafted AIX partition table is detected by the kernel, such as when attaching a malicious image via losetup or during automatic scanning by udev. The fix bounds the scan loop to the actual size of the ppe array to prevent out-of-bounds access.

An attacker can supply a crafted AIX partition table image that causes the kernel to read memory beyond the allocated bounds of the ppe array during partition scanning. This out-of-bounds read could potentially lead to information disclosure or kernel memory corruption. The vulnerability is triggered without mounting the filesystem, during device detection or setup. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to clamp the pp_count scan to the size of the allocated ppe array, preventing out-of-bounds reads. Users should apply the official kernel updates that include this patch once available. Since this is a kernel-level vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not yet confirmed in the provided data; check the Linux kernel vendor advisory for current remediation guidance.