The flaw occurs when the io_uring subsystem reads user‑supplied buffer lengths without using the READ_ONCE() macro. The kernel therefore reads a value that may change before subsequent actions are performed, which means the kernel could commit data with an incorrect or zero length. Such a mismatch can corrupt data or block further progress, potentially leading to a denial of service. The description explicitly notes that the buffer may change between selection and commitment, underscoring the risk of an inconsistent length being used.

All Linux kernel releases not yet incorporating the READ_ONCE() change for io_uring buffer lengths are affected. The CPE data lists every generic Linux kernel as well as the 6.17 release candidates (RC1, RC2, RC3). Kernel 6.17 RC1 and newer contain the fix, so older kernels up to but not including those releases remain vulnerable.

The CVSS score of 5.5 indicates moderate severity; the EPSS score of less than 1% suggests that exploitation is unlikely in the wild. The vulnerability is not catalogued in the CISA KEV list. Based on the description, it is inferred that the attack vector would involve a local user process that submits carefully crafted io_uring requests with manipulated buffer lengths. This inference is not directly stated in the official data.