The Linux kernel formats AF_RXRPC socket addresses into a fixed 50‑byte stack buffer using the %pISpc conversion specifier. For certain IPv6–to‑IPv4 mapped or ISATAP addresses, the string representation can be 50 characters long, requiring 51 bytes when the terminating NUL byte is added. Because the buffer is only 50 bytes, the formatting operation overflows the stack, corrupting kernel memory. This defect can cause a kernel crash, random kernel state changes, or other unpredictable behavior, but does not provide direct code execution or clear privilege escalation from the information supplied.

All kernel releases that include the original AF_RXRPC procfs code with the 50‑byte buffer are vulnerable. The CPE data lists kernel version 4.9 and all 7.0 release candidates up to rc7, so any distribution shipping those kernels without the upstream patch is affected until a fix is applied.

The CVSS score of 7.8 indicates high severity, while the EPSS score of <1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits. Exploitation depends on the kernel formatting an oversized address representation, a condition that is not trivially engineered remotely, so the practical risk is high severity but low exploitation probability.