A signed 32‑bit overflow occurs when userspace submits an io_uring submission queue entry (sqe) whose len field, a 32‑bit unsigned value, exceeds INT_MAX. The overflow produces a negative signed length that is later misinterpreted as an astronomically large size in the kernel’s recv/send logic. The kernel then repeatedly reads past the end of the iovec array while chaining buffers, eventually performing a slab‑out‑bound read from the kmalloc‑64 slab. This read can expose arbitrary kernel memory contents and may cause a crash, resulting in information disclosure or denial of service.

Any Linux kernel build that lacks the fix which rejects negative sr->len values in io_sendmsg_prep() and io_recvmsg_prep() is impacted. The CVE data explicitly lists kernel 7.0 release candidates RC1 through RC6 as vulnerable; earlier releases built before the commit are also vulnerable until patched.

Based on the description, it is inferred that the attacker must have local code execution to submit crafted io_uring requests. The flaw requires a local user to run code that submits such requests; remote exploitation is not possible unless the attacker can execute local code. The CVSS score of 7.1 indicates a medium‑high severity, while the EPSS score of less than 1% reflects a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would result in a kernel out‑of‑bounds read; the attack surface is limited to systems with io_uring enabled in the kernel and in user processes.