A critical out-of-bounds memory read vulnerability in the Linux kernel Greybus subsystem could allow an unauthenticated attacker on the local network to compromise system integrity and availability.

The Greybus audio driver fails to validate topology section sizes against the actual fetched blob size, leading to an out-of-bounds read when parsing malformed data. An unauthenticated attacker can trigger this condition by providing a topology blob with large section sizes.

The vulnerability carries a CVSS score of 8.8, indicating a high level of risk. Successful exploitation could result in unauthorized memory access, potentially leading to sensitive data exposure or system crashes, which directly impacts service uptime and data confidentiality.

Immediate Action: Update the Linux kernel to version 5.10.270, 5.15.221, 6.1.188, 6.6.157, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel-related segmentation faults or unexpected crashes occurring in the Greybus or audio subsystems.

Compensating Controls: Restrict access to the Greybus subsystem and ensure that only trusted modules are permitted to interface with the kernel audio topology parsing functions.

Public Exploit Available: Unknown.

Given the severity of this kernel-level flaw, organizations should prioritize patching affected systems. Administrators must ensure that kernel updates are tested and deployed in accordance with standard patch management cycles to mitigate the risk of unauthorized access or system instability.