The flaw lies in the Linux kernel's handling of RxGK token data during the add_key() system call. Raw key and ticket lengths are read as 32‑bit values and rounded up before allocation. If a length reaches or exceeds 0xFFFFFFFD, the rounding function wraps to zero, causing the kernel to allocate a zero‑byte buffer yet subsequently copy almost 4 GiB of data into it. This overflow can corrupt the heap, leading to undefined behavior and enabling an unprivileged user to trigger local privilege escalation by corrupting kernel memory. The vulnerability is a classic heap buffer overflow (CWE‑125) coupled with a signed integer wraparound (CWE‑190).

Linux kernel versions 6.16 and all 7.0 release candidates from rc1 through rc7 are impacted until the flaw is patched. Any system running these kernels and allowing the add_key() operation is vulnerable.

The CVSS score of 7.8 rates the flaw as high severity, while the EPSS score of less than 1% indicates a low probability of current exploitation. It is not listed in the CISA KEV catalog, suggesting no widespread active exploitation yet. The flaw can be triggered from user space via the unprivileged add_key() call, requiring no elevated privileges. Attackers would need to supply a crafted RxGK token to an enabled RxRPC component. Successful exploitation could lead to full local privilege escalation if memory corruption is leveraged effectively. Overall, the risk is significant for systems that regularly process RxGK tokens or expose add_key() to untrusted users.