The Linux kernel's dm-verity-fec implementation had a flaw in fec_decode_bufs() where it assumed parity bytes for the first RS codeword are never split across parity blocks. This assumption fails under certain conditions involving fec_roots and buffer counts, causing an out-of-bounds read from the parity block buffer. This vulnerability is triggered only with specific fec_roots values (17, 19, 21, 23) combined with particular buffer counts, often when memory allocation is constrained. The issue was resolved by refactoring the parity block reading logic to correctly handle parity bytes split across blocks. The affected product is linux-hwe-edge with versions prior to 7.0.0-28.28.1 vulnerable. The CVSS 3.1 vector indicates local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact.

The vulnerability allows an out-of-bounds read in the Linux kernel's dm-verity-fec component, potentially leading to a denial of service due to corrupted parity data processing. Confidentiality impact is rated high per CVSS, indicating possible exposure of sensitive data during the out-of-bounds read. Integrity impact is not affected. Availability impact is high, suggesting potential system instability or crashes. Exploitation requires local access with low privileges and no user interaction. The flaw occurs only under specific non-default configurations and low memory conditions, limiting its practical exploitation.

A fix is available in linux-hwe-edge version 7.0.0-28.28.1 and later. Users should upgrade to this version or newer to remediate the vulnerability. Since this is a kernel-level issue, applying the official kernel update from the vendor is the recommended remediation. No alternative mitigations are indicated.