A memory corruption flaw in the Linux kernel QNAP MCU driver enables local privilege escalation and system instability, presenting a high risk to affected systems.

The vulnerability stems from an insecure handling of the receive buffer in the qnap_mcu_exec function, where the driver retains a pointer to an on-stack buffer after a command timeout. A local user with low privileges can trigger this state to write data into a freed stack frame, resulting in memory corruption.

The vulnerability carries a CVSS score of 7.8, reflecting its potential for complete system compromise. Because successful exploitation allows for arbitrary memory writes, an attacker could escalate privileges to root or cause a kernel panic, leading to unauthorized data access and significant service downtime for the affected host.

Immediate Action: Update the Linux kernel to version 6.18.51, 7.2.4, or a later stable release where the receive buffer has been moved to the persistent driver structure.

Proactive Monitoring: Monitor system logs for unexpected kernel oops or panic messages that may indicate memory corruption events associated with the QNAP MCU driver.

Compensating Controls: Restrict access to the system to authorized users only, as the attack vector requires local, authenticated access to interact with the vulnerable driver interface.

Public Exploit Available: Unknown

Given the severity of potential kernel-level memory corruption, administrators should prioritize patching the Linux kernel across all affected environments. While the exploit requires local access, the ability to achieve privilege escalation makes this a high-priority update for any system utilizing the affected QNAP MCU driver.