An unauthenticated remote attacker can trigger an out of bounds memory write in the Linux kernel stm32 CEC driver, potentially leading to system instability or arbitrary code execution.

The stm32_rx_done function fails to validate the length of incoming CEC messages against the fixed 16 byte buffer size before writing to memory. This allows an unauthenticated remote CEC peer to drive the interrupt handler to write data past the buffer boundary, resulting in memory corruption.

The vulnerability carries a CVSS score of 8.8, indicating a high severity risk. Successful exploitation could allow an attacker to crash the system, cause denial of service, or potentially execute arbitrary code with kernel level privileges, which would result in a total compromise of system integrity and confidentiality.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or later versions where the fix has been backported.

Proactive Monitoring: Monitor system logs for kernel panic events or unusual interrupt activity related to the stm32 cec driver.

Compensating Controls: If patching is not immediately feasible, disable the stm32 CEC driver module if it is not required for system operations to eliminate the attack surface.

Public Exploit Available: Unknown

Given the high CVSS score and the potential for kernel level memory corruption, this vulnerability represents a significant threat to system stability and security. Administrators should prioritize applying the provided kernel patches to all affected systems, particularly those exposed to external CEC devices, to prevent potential exploitation.