The vulnerability allows a local actor to trigger a slab‑out‑of‑bounds read in the Linux kernel by issuing an io_uring import with a zero‑length buffer. The validate_fixed_range function incorrectly accepts a buffer address that lies exactly at the end of a registered region when the length is zero. As a result, io_import_fixed calculates an offset equal to the buffer length and walks the underlying bvec array one step beyond its last valid entry, reading a bvec offset from memory beyond the allocated slab. This causes a kernel crash as reported by KASAN, potentially terminating the offending process or the entire system. The flaw is a buffer overflow (CWE‑125) and a memory read (CWE‑805), with no direct code execution.

All Linux kernel builds that have not yet incorporated the patch commits 040a1e7e0e2f01851fec1dd2d96906f8636a9f75, 111a12b422a8cfa93deabaef26fec48237163214, or 40170fc1a79c1b2e68f09ae6aac687b7305ae6f4 are potentially vulnerable. The advisory lists the vendor as Linux:Linux, indicating that the issue affects the kernel itself rather than a specific distribution. Precise version ranges are not provided, so administrators should verify whether their running kernel includes these commits.

Risk remains significant due to a CVSS score of 7.1. The EPSS score of 0.00013 indicates a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker must be able to submit a crafted io_uring syscall with a zero‑length import; this could be performed by a local user or an unprivileged process that can craft the call. While the vulnerability occurs in the kernel, a successful crash may provide a weak path to privilege escalation, but such an outcome has not been demonstrated.