The Linux kernel's PTP OCP driver had a vulnerability where the EEPROM board ID, a fixed 13-byte field without guaranteed null termination, was passed directly to devlink_info_version_fixed_put() as a C string. This could lead to reading memory beyond the intended buffer. The patch addresses this by formatting at most 13 bytes into the local buffer and using a precision limit in snprintf() to prevent scanning beyond the source string.

This vulnerability could cause out-of-bounds memory reads when processing the EEPROM board ID in the Linux kernel's PTP OCP driver. Such over-reads may lead to information disclosure or kernel instability depending on context. However, no known exploits in the wild have been reported.

A fix has been applied to the Linux kernel to properly limit the board ID string length and prevent over-read. Users should update to the fixed kernel version containing this patch. Patch status is not explicitly stated in the provided data; check the official Linux kernel advisories or vendor updates for the exact fixed versions and apply them accordingly.