When a virtual memory area is modified during a merge, the kernel mistakenly keeps a stale end address for the current VMA. This causes the following iteration to start at an incorrect offset, potentially corrupting kernel data structures or causing invalid memory accesses. The flaw could allow an attacker with sufficient privileges to execute arbitrary code or destabilize the system.

The bug resides in the mm/mseal component of the Linux kernel. Every Linux kernel that does not contain the patch that updates the VMA end during a merge operation is vulnerable. Distribution vendors have not yet released a version that incorporates the commit, so any kernel older than the fix commit is affected.

The exploit probability is very low, with an EPSS score below 1% and no known wild exploits listed in the CISA KEV catalog. Successful exploitation would require local kernel privileges or the ability to load a kernel module, making remote attack unlikely. The vulnerability is unassisted and leverages a kernel memory mapping bug, so any local attacker could potentially gain full control if the flaw is triggered.