The Linux kernel memory‑management subsystem contains a logic flaw in the VMA merge routine. When a VMA is modified by vma_modify_flags() the end address can become stale, yet the code continues to use this outdated value to set the start of the next VMA. This can lead the kernel to treat a region as outside of the VMA bounds, potentially overwriting or misreading kernel memory. The description does not explicitly state a current exploitation vector, but the effect is a corruption of kernel memory boundaries, which could in turn allow privilege escalation or denial of service if an attacker can trigger the merge logic.

All Linux kernel builds that include the mm/mseal VMA logic before the patch commit are potentially affected. No explicit version numbers are provided, so any running kernel that has not integrated the described commit may be vulnerable.

The CVSS score is not listed and the EPSS score is less than 1 %. The vulnerability is not in the CISA KEV catalog. Exploitation would require kernel‑privileged code to invoke vma_modify_flags() and induce the stale value condition. While the potential impact on kernel memory integrity is serious, the low probability of exploitation and absence of known public exploits reduce the immediate risk for most environments.