In the Linux kernel, a signedness mismatch occurs when handling io_uring buffers: the unsigned buffer length stored in buf->len is implicitly cast to a signed integer during commit. If the length is large enough to be represented as a negative value in a signed int, the resulting value propagates into a min_t calculation that can behave unexpectedly. This misinterpretation can lead to memory corruption or other unexpected kernel behavior.

The issue is present in the Linux kernel 6.17 release candidates rc1, rc2 and rc3, as identified by the CPE strings. Any kernel that incorporates the affected code path during these releases or in derivative kernels that are built from them remains vulnerable. Versions released after the signedness fix are not explicitly listed in the CVE data, so their status is unknown.

The CVSS score of 5.5 denotes medium severity, and the EPSS score of less than 1% indicates a very low probability of current exploitation. The vulnerability is not catalogued in the CISA KEV database. Based on the description, it is inferred that the attack vector would involve a user‑controlled io_uring request with an unusually large buffer length.