The flaw is caused by an incorrect use of container_of on a file pointer in the IMA appraise measurement function, resulting in a stack-out-of-bounds read during is_bprm_creds_for_exec(); this stack read beyond allocated bounds is a buffer under-read vulnerability (CWE-125) that can expose data stored on the kernel stack or lead to a crash when privileged code processes a binary measurement.

All Linux kernel releases that contain the IMA appraiser framework before the commit inserting the bprm_is_check boolean are affected. The vulnerability applies to every distribution running an unpatched kernel that has the IMA module enabled.

Based on the description, the likely attack vector is a local attacker who can execute privileged code that triggers IMA measurement, such as via sudo or privileged binary execution. The flaw is a local kernel read beyond the allocated buffer (CWE‑125) that can lead to information disclosure or kernel instability for privileged users. The CVSS v3 score is 7.1, indicating a medium‑to‑high severity, while the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting a low to medium exploitation probability. No direct remote code execution pathway has been reported.